theory Delete_C

lemma reduceZombie_ccorres1:
  assumes fs_cc:
    "\<And>slot. \<lbrakk> capZombieNumber cap \<noteq> 0; expo;
               (slot, s) \<in> fst (locateSlotCap cap
                               (fromIntegral (capZombieNumber cap - 1)) s) \<rbrakk> \<Longrightarrow>
     ccorres (cintr \<currency> (\<lambda>(success, irqopt) (success', irq'). success' = from_bool success \<and> ccap_relation irqopt irq' \<and> cleanup_info_wf' irqopt))
     (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (success_C v, finaliseSlot_ret_C.cleanupInfo_C v))
                   ret__struct_finaliseSlot_ret_C_')
     (\<lambda>s. invs' s \<and> sch_act_simple s \<and> ex_cte_cap_to' slot s)
     (UNIV \<inter> {s. slot_' s = Ptr slot} \<inter> {s. immediate_' s = from_bool False}) []
     (cutMon ((=) s) (finaliseSlot slot False)) (Call finaliseSlot_'proc)"
  shows
  "isZombie cap \<Longrightarrow>
   ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_' )
     (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot)
     (UNIV \<inter> {s. slot_' s = Ptr slot} \<inter> {s. immediate_' s = from_bool expo}) []
     (cutMon ((=) s) (reduceZombie cap slot expo)) (Call reduceZombie_'proc)" apply (cinit' lift: slot_' immediate_') apply (simp add: from_bool_0 del: Collect_const) apply (rule_tac P="capZombieNumber cap < 2 ^ word_bits" in ccorres_gen_asm) apply (rule ccorres_move_c_guard_cte) apply (rule_tac xf'=ret__unsigned_long_'
               and val="capZombiePtr cap"
               and R="cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs'"
            in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply vcg apply clarsimp apply (erule(2) zombie_rf_sr_helperE) apply simp apply (clarsimp simp: ccap_zombie_radix_less4) apply ceqv apply csymbr apply (rule ccorres_move_c_guard_cte) apply (rule_tac xf'=n_'
                and val="of_nat (capZombieNumber cap)"
                and R="cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs'"
             in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply (rule conseqPre, vcg) apply clarsimp apply (erule(2) zombie_rf_sr_helperE) apply simp apply fastforce apply ceqv apply (rule ccorres_move_c_guard_cte) apply (rule_tac xf'=ret__unsigned_'
                 and val="case_zombie_type ZombieTCB_C of_nat (capZombieType cap)"
                 and R="cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs'"
              in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply vcg apply clarsimp apply (erule(2) zombie_rf_sr_helperE) apply simp apply clarsimp apply ceqv apply csymbr apply (simp add: reduceZombie_def del: Collect_const) apply (simp only: cutMon_walk_if) apply (rule ccorres_if_lhs) apply (simp, rule ccorres_drop_cutMon, rule ccorres_fail) apply (rule ccorres_if_lhs) apply (simp add: Let_def Collect_True Collect_False assertE_assert liftE_bindE
                   del: Collect_const) apply (rule ccorres_drop_cutMon, rule ccorres_assert) apply (rule ccorres_rhs_assoc)+ apply (simp add: liftE_bindE liftM_def case_assertE_to_assert
                   del: Collect_const) apply (rule ccorres_symb_exec_l[OF _ getCTE_inv _ empty_fail_getCTE]) apply (rule ccorres_assert) apply (rule ccorres_move_c_guard_cte) apply (rule ccorres_symb_exec_r) apply (simp add: liftE_liftM liftM_def) apply (ctac(no_vcg) add: capSwapForDelete_ccorres) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (simp add: return_def) apply wp apply vcg apply (rule conseqPre, vcg) apply clarsimp apply wp apply (rule ccorres_if_lhs) apply (simp add: Let_def liftE_bindE del: Collect_const) apply (rule ccorres_cutMon_locateSlotCap_Zombie) apply (simp add: cutMon_walk_bindE Collect_True del: Collect_const) apply (rule ccorres_rhs_assoc ccorres_move_c_guard_cte ccorres_Guard_Seq)+ apply csymbr apply (ctac(no_vcg, no_simp) add: cteDelete_ccorres1) apply (rule ccorres_guard_imp2) apply (rule fs_cc, clarsimp+)[1] apply simp apply (rule ccorres_drop_cutMon) apply (simp add: Collect_False del: Collect_const) apply (rule ccorres_rhs_assoc ccorres_move_c_guard_cte)+ apply (rule ccorres_symb_exec_l[OF _ getCTE_inv _ empty_fail_getCTE]) apply (rule_tac F="\<lambda>rv'. \<exists>cp. ccap_relation (cteCap rv) cp
                                      \<and> rv' = cap_get_tag cp"
                      and xf'=ret__unsigned_'
                      and R="cte_wp_at' ((=) rv) slot"
                   in ccorres_symb_exec_r_abstract_UNIV[where R'=UNIV]) apply (rule conseqPre, vcg) apply (clarsimp simp: cte_wp_at_ctes_of) apply (erule(1) cmap_relationE1[OF cmap_relation_cte]) apply (clarsimp dest!: ccte_relation_ccap_relation simp: typ_heap_simps) apply fastforce apply ceqv apply (clarsimp simp: cap_get_tag_isCap simp del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply simp apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: returnOk_def return_def) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: Let_def del: Collect_const) apply (rule ccorres_move_c_guard_cte ccorres_rhs_assoc)+ apply (rule_tac xf'=ret__unsigned_long_'
                        and val="capZombiePtr (cteCap rv)"
                        and R="cte_wp_at' ((=) rv) slot and invs'"
                     in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply (rule conseqPre, vcg) apply clarsimp apply (erule(2) zombie_rf_sr_helperE) apply simp apply (clarsimp simp: ccap_zombie_radix_less4) apply ceqv apply csymbr apply csymbr apply (simp only: if_1_0_0 simp_thms) apply (rule ccorres_Cond_rhs_Seq[rotated]) apply (simp add: assertE_assert liftE_def) apply (rule ccorres_assert) apply (rule ccorres_cond_false_seq | simp)+ apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_move_c_guard_cte) apply (rule_tac xf'=ret__unsigned_long_'
                         and val="of_nat (capZombieNumber (cteCap rv))"
                         and R="cte_wp_at' ((=) rv) slot and invs'"
                      in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply (rule conseqPre, vcg) apply clarsimp apply (erule(2) zombie_rf_sr_helperE) apply simp apply fastforce apply ceqv apply csymbr apply (simp only: if_1_0_0 simp_thms) apply (rule ccorres_Cond_rhs_Seq[rotated]) apply (rule_tac P="\<exists>s. s \<turnstile>' cteCap rv \<and> s \<turnstile>' cap" in ccorres_gen_asm) apply (clarsimp simp: word_unat.Abs_inject valid_cap_capZombieNumber_unats) apply (simp add: assertE_def) apply (rule ccorres_fail) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_move_c_guard_cte) apply (rule_tac xf'=ret__unsigned_'
                          and val="case_zombie_type ZombieTCB_C of_nat (capZombieType (cteCap rv))"
                          and R="cte_wp_at' ((=) rv) slot and invs'"
                       in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply (rule conseqPre, vcg) apply clarsimp apply (erule(2) zombie_rf_sr_helperE) apply simp subgoal by clarsimp apply ceqv apply csymbr apply (simp only: if_1_0_0 simp_thms) apply (rule ccorres_Cond_rhs_Seq) apply (rule_tac P="\<exists>s. s \<turnstile>' cap \<and> s \<turnstile>' cteCap rv" in ccorres_gen_asm) apply (subgoal_tac "P" for P, subst if_P, assumption) prefer 2 apply (clarsimp simp: word_unat.Abs_inject valid_cap_capZombieNumber_unats) apply (drule valid_capAligned)+ apply (drule(4) case_zombie_type_map_inj) apply simp apply (rule ccorres_rhs_assoc)+ apply (simp del: Collect_const) apply (rule ccorres_move_c_guard_cte) apply (simp add: liftE_def bind_assoc del: Collect_const) apply (rule ccorres_symb_exec_l [OF _ getCTE_inv _ empty_fail_getCTE]) apply (rule ccorres_assert) apply (rule_tac xf'=ret__struct_cap_C_'
                             and F="\<lambda>rv'. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'"
                             and R="cte_wp_at' ((=) rv) slot and invs'"
                          in ccorres_symb_exec_r_abstract_UNIV[where R'=UNIV]) apply (rule conseqPre, vcg) apply clarsimp apply (erule(2) zombie_rf_sr_helperE, simp) apply clarsimp apply (rule exI, rule conjI, assumption, clarsimp) apply (rule ssubst, rule unat_minus_one) apply (erule of_nat_neq_0) apply (drule(1) valid_cap_capZombieNumber_unats) subgoal by (simp add: unats_def) apply (rule conjI) apply (clarsimp simp: isCap_simps valid_cap'_def) apply (erule order_trans[rotated]) apply (rule order_trans, rule diff_le_self) subgoal by (simp add: unat_of_nat) apply clarsimp apply (erule_tac P="\<lambda>cap. ccap_relation cap cap'" for cap' in rsubst) apply (clarsimp simp: isCap_simps capAligned_def) apply (drule valid_cap_capZombieNumber_unats | simp)+ apply (simp add: word_unat.Abs_inverse) apply ceqv apply (rule ccorres_move_c_guard_cte) apply (ctac(no_vcg) add: ccorres_updateCap) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply wp apply simp apply (simp add: guard_is_UNIV_def Collect_const_mem) apply (clarsimp simp: isCap_simps) apply wp apply (subst if_not_P) apply clarsimp apply (simp add: assertE_assert liftE_def) apply (rule ccorres_fail) apply (simp add: guard_is_UNIV_def)+ apply (rule ccorres_fail) apply (simp add: guard_is_UNIV_def) apply (simp add: conj_comms) apply (wp getCTE_wp) apply simp apply (rule ccorres_split_throws) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def cintr_def) apply vcg apply (wp cutMon_validE_drop) apply (rule_tac Q'="\<lambda>rv. invs' and cte_at' slot and valid_cap' cap" in hoare_post_imp_R) apply (wp cteDelete_invs'') apply (clarsimp simp: cte_wp_at_ctes_of) apply (fastforce dest: ctes_of_valid') apply (rule ccorres_inst[where P=\<top> and P'=UNIV]) apply simp apply (simp add: guard_is_UNIV_def Collect_const_mem) apply (clarsimp simp: isCap_simps size_of_def cte_level_bits_def) apply (simp only: word_bits_def unat_of_nat unat_arith_simps, simp) apply (simp add: guard_is_UNIV_def)+ apply (clarsimp simp: cte_wp_at_ctes_of) apply (clarsimp simp: isCap_simps) apply (frule ctes_of_valid', clarsimp+) apply (frule valid_Zombie_number_word_bits, clarsimp+) apply (frule(1) ex_Zombie_to2, clarsimp+) apply (clarsimp simp: cte_level_bits_def) apply (frule_tac n="v2 - 1" in valid_Zombie_cte_at') apply (fastforce simp add: valid_cap'_def) apply (frule_tac n=0 in valid_Zombie_cte_at') apply (fastforce simp: valid_cap'_def) apply (clarsimp simp: cte_wp_at_ctes_of size_of_def objBits_defs) apply auto done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. isZombie cap \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) (UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool expo\<rbrace>) [] (cutMon ((=) s) (reduceZombie cap slot expo)) (Call reduceZombie_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2397 immediate slota) (?Q'2397 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))));;
(\<acute>ptr___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned_long;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>n :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF immediate \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptr___ptr_to_struct_cte_C_' s +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== \<acute>ptr___ptr_to_struct_cte_C +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if \<acute>ptr___ptr_to_struct_cte_C = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])),\<acute>n - SCAST(32 signed \<rightarrow> 32) 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(slota\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ptr___ptr_to_struct_cte_C_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>ptr___ptr_to_struct_cte_C\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(\<acute>ptr___ptr_to_struct_cte_C,slota)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2397 immediate slota s \<and> s' \<in> ?Q'2397 immediate slota proof (prove)
goal (2 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2397 (from_bool expo) (cte_Ptr slot)) (?Q'2397 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>ptr___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned_long;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>n :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptr___ptr_to_struct_cte_C_' s +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== \<acute>ptr___ptr_to_struct_cte_C +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if \<acute>ptr___ptr_to_struct_cte_C = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ptr___ptr_to_struct_cte_C_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>ptr___ptr_to_struct_cte_C\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(\<acute>ptr___ptr_to_struct_cte_C,cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2397 immediate slota s \<and> s' \<in> ?Q'2397 immediate slota proof (prove)
goal (2 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G2407 (from_bool expo) (cte_Ptr slot)) (?Q'2397 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>ptr___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned_long;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>n :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptr___ptr_to_struct_cte_C_' s +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== \<acute>ptr___ptr_to_struct_cte_C +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if \<acute>ptr___ptr_to_struct_cte_C = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ptr___ptr_to_struct_cte_C_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>ptr___ptr_to_struct_cte_C\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(\<acute>ptr___ptr_to_struct_cte_C,cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G2407 immediate slota and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> ?Q'2397 immediate slota proof (prove)
goal (2 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A2413 (from_bool expo) (cte_Ptr slot)) (?C'2410 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])));;
(\<acute>ptr___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned_long;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>n :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptr___ptr_to_struct_cte_C_' s +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== \<acute>ptr___ptr_to_struct_cte_C +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if \<acute>ptr___ptr_to_struct_cte_C = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ptr___ptr_to_struct_cte_C_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>ptr___ptr_to_struct_cte_C\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(\<acute>ptr___ptr_to_struct_cte_C,cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A2413 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> ?C'2410 immediate slota \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>immediate slota s. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned_long = capZombiePtr cap\<rbrace>)
 2. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ptr___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned_long;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>n :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptr___ptr_to_struct_cte_C_' s +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== \<acute>ptr___ptr_to_struct_cte_C +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if \<acute>ptr___ptr_to_struct_cte_C = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ptr___ptr_to_struct_cte_C_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>ptr___ptr_to_struct_cte_C\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(\<acute>ptr___ptr_to_struct_cte_C,cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?y'2416 immediate slota rv')
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2419 (from_bool expo) (cte_Ptr slot)) (?Q2416 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'2416 immediate slota (capZombiePtr cap))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. ?Q2416 immediate slota)
 5. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P2419 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') s \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> get_capZombieBits_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 0x1F \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_long_' := get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))\<rparr>) \<in> rf_sr \<and> get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr cap)}
 2. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ptr___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned_long;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>n :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptr___ptr_to_struct_cte_C_' s +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== \<acute>ptr___ptr_to_struct_cte_C +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if \<acute>ptr___ptr_to_struct_cte_C = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ptr___ptr_to_struct_cte_C_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>ptr___ptr_to_struct_cte_C\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(\<acute>ptr___ptr_to_struct_cte_C,cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?y'2416 immediate slota rv')
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2419 (from_bool expo) (cte_Ptr slot)) (?Q2416 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'2416 immediate slota (capZombiePtr cap))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. ?Q2416 immediate slota)
 5. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P2419 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s x. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s; invs' s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> get_capZombieBits_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 0x1F \<and> get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr cap
 2. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ptr___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned_long;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>n :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptr___ptr_to_struct_cte_C_' s +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== \<acute>ptr___ptr_to_struct_cte_C +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if \<acute>ptr___ptr_to_struct_cte_C = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ptr___ptr_to_struct_cte_C_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>ptr___ptr_to_struct_cte_C\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(\<acute>ptr___ptr_to_struct_cte_C,cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?y'2416 immediate slota rv')
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2419 (from_bool expo) (cte_Ptr slot)) (?Q2416 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'2416 immediate slota (capZombiePtr cap))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. ?Q2416 immediate slota)
 5. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P2419 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s x cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; invs' s; (s, x) \<in> rf_sr; cteCap cte = cap\<rbrakk> \<Longrightarrow> isZombie (cteCap cte)
 2. \<And>s x capa ccap cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; invs' s; (s, x) \<in> rf_sr; capa = cteCap cte; ccap = h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])); cteCap cte = cap; ccap_relation capa ccap; capAligned capa; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift ccap) = capZombiePtr capa; capZombieType_CL (cap_zombie_cap_lift ccap) = (case capZombieType capa of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> get_capZombieBits_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 0x1F \<and> get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr cap
 3. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ptr___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned_long;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>n :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptr___ptr_to_struct_cte_C_' s +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== \<acute>ptr___ptr_to_struct_cte_C +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if \<acute>ptr___ptr_to_struct_cte_C = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ptr___ptr_to_struct_cte_C_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>ptr___ptr_to_struct_cte_C\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(\<acute>ptr___ptr_to_struct_cte_C,cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?y'2416 immediate slota rv')
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2419 (from_bool expo) (cte_Ptr slot)) (?Q2416 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'2416 immediate slota (capZombiePtr cap))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. ?Q2416 immediate slota)
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P2419 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s x capa ccap cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; invs' s; (s, x) \<in> rf_sr; capa = cteCap cte; ccap = h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])); cteCap cte = cap; ccap_relation capa ccap; capAligned capa; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift ccap) = capZombiePtr capa; capZombieType_CL (cap_zombie_cap_lift ccap) = (case capZombieType capa of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> get_capZombieBits_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 0x1F \<and> get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr cap
 2. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ptr___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned_long;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>n :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptr___ptr_to_struct_cte_C_' s +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== \<acute>ptr___ptr_to_struct_cte_C +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if \<acute>ptr___ptr_to_struct_cte_C = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ptr___ptr_to_struct_cte_C_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>ptr___ptr_to_struct_cte_C\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(\<acute>ptr___ptr_to_struct_cte_C,cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?y'2416 immediate slota rv')
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2419 (from_bool expo) (cte_Ptr slot)) (?Q2416 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'2416 immediate slota (capZombiePtr cap))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. ?Q2416 immediate slota)
 5. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P2419 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ptr___ptr_to_struct_cte_C :== cte_Ptr \<acute>ret__unsigned_long;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>n :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptr___ptr_to_struct_cte_C_' s +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== \<acute>ptr___ptr_to_struct_cte_C +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if \<acute>ptr___ptr_to_struct_cte_C = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ptr___ptr_to_struct_cte_C_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>ptr___ptr_to_struct_cte_C\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(\<acute>ptr___ptr_to_struct_cte_C,cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?y'2416 immediate slota rv')
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2419 (from_bool expo) (cte_Ptr slot)) (?Q2416 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'2416 immediate slota (capZombiePtr cap))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. ?Q2416 immediate slota)
 4. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P2419 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2419 (from_bool expo) (cte_Ptr slot)) (?Q2416 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (\<acute>ptr___ptr_to_struct_cte_C :== cte_Ptr (capZombiePtr cap);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>n :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptr___ptr_to_struct_cte_C_' s +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion \<acute>ptr___ptr_to_struct_cte_C (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== \<acute>ptr___ptr_to_struct_cte_C +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if \<acute>ptr___ptr_to_struct_cte_C = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ptr___ptr_to_struct_cte_C_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>ptr___ptr_to_struct_cte_C\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(\<acute>ptr___ptr_to_struct_cte_C,cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. ?Q2416 immediate slota)
 3. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P2419 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2419 (from_bool expo) (cte_Ptr slot)) (?G'2900 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>n :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> ?G'2900 immediate slota})
 3. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P2419 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3513 (from_bool expo) (cte_Ptr slot)) (?C'3511 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (\<acute>n :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> ?C'3511 immediate slota \<inter> \<lbrace>True\<rbrace>})
 3. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A3513 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota s. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') s \<and> (s, s') \<in> rf_sr}) \<acute>n :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>n = word_of_nat (capZombieNumber cap)\<rbrace>)
 2. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> n_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?y'3516 immediate slota rv')
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3519 (from_bool expo) (cte_Ptr slot)) (?Q3516 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'3516 immediate slota (word_of_nat (capZombieNumber cap)))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. ?Q3516 immediate slota)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P3519 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota s. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') s \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> isZombie capa \<and> capAligned capa \<and> (\<forall>t. ret__unsigned_long_' t = word_of_nat (capZombieNumber capa) \<longrightarrow> (s, n_'_update (\<lambda>_. word_of_nat (capZombieNumber capa)) sa) \<in> rf_sr \<and> word_of_nat (capZombieNumber capa) = word_of_nat (capZombieNumber cap))}
 2. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> n_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?y'3516 immediate slota rv')
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3519 (from_bool expo) (cte_Ptr slot)) (?Q3516 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'3516 immediate slota (word_of_nat (capZombieNumber cap)))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. ?Q3516 immediate slota)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P3519 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s x. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s; invs' s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> isZombie capa \<and> capAligned capa \<and> ((\<exists>t. ret__unsigned_long_' t = word_of_nat (capZombieNumber capa)) \<longrightarrow> word_of_nat (capZombieNumber capa) = word_of_nat (capZombieNumber cap))
 2. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> n_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?y'3516 immediate slota rv')
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3519 (from_bool expo) (cte_Ptr slot)) (?Q3516 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'3516 immediate slota (word_of_nat (capZombieNumber cap)))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. ?Q3516 immediate slota)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P3519 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s x cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; invs' s; (s, x) \<in> rf_sr; cteCap cte = cap\<rbrakk> \<Longrightarrow> isZombie (cteCap cte)
 2. \<And>s x capa ccap cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; invs' s; (s, x) \<in> rf_sr; capa = cteCap cte; ccap = h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])); cteCap cte = cap; ccap_relation capa ccap; capAligned capa; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift ccap) = capZombiePtr capa; capZombieType_CL (cap_zombie_cap_lift ccap) = (case capZombieType capa of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> isZombie capa \<and> capAligned capa \<and> ((\<exists>t. ret__unsigned_long_' t = word_of_nat (capZombieNumber capa)) \<longrightarrow> word_of_nat (capZombieNumber capa) = word_of_nat (capZombieNumber cap))
 3. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> n_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?y'3516 immediate slota rv')
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3519 (from_bool expo) (cte_Ptr slot)) (?Q3516 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'3516 immediate slota (word_of_nat (capZombieNumber cap)))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. ?Q3516 immediate slota)
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P3519 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s x capa ccap cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; invs' s; (s, x) \<in> rf_sr; capa = cteCap cte; ccap = h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])); cteCap cte = cap; ccap_relation capa ccap; capAligned capa; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift ccap) = capZombiePtr capa; capZombieType_CL (cap_zombie_cap_lift ccap) = (case capZombieType capa of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> isZombie capa \<and> capAligned capa \<and> ((\<exists>t. ret__unsigned_long_' t = word_of_nat (capZombieNumber capa)) \<longrightarrow> word_of_nat (capZombieNumber capa) = word_of_nat (capZombieNumber cap))
 2. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> n_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?y'3516 immediate slota rv')
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3519 (from_bool expo) (cte_Ptr slot)) (?Q3516 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'3516 immediate slota (word_of_nat (capZombieNumber cap)))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. ?Q3516 immediate slota)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P3519 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> n_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (n_' s - 1))} (Guard MemorySafety \<lbrace>\<acute>n = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (\<acute>n - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (\<acute>n - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = \<acute>n then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),\<acute>n - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?y'3516 immediate slota rv')
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3519 (from_bool expo) (cte_Ptr slot)) (?Q3516 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'3516 immediate slota (word_of_nat (capZombieNumber cap)))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. ?Q3516 immediate slota)
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P3519 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3519 (from_bool expo) (cte_Ptr slot)) (?Q3516 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. ?Q3516 immediate slota)
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 4. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P3519 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A4138 (from_bool expo) (cte_Ptr slot)) (?C'4136 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])));;
(\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. ?C'4136 immediate slota \<inter> \<lbrace>True\<rbrace>)
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 4. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A4138 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>immediate slota s. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrace>)
 2. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?y'4141 immediate slota rv')
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4144 (from_bool expo) (cte_Ptr slot)) (?Q4141 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'4141 immediate slota (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. ?Q4141 immediate slota)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P4144 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') s \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))\<rparr>) \<in> rf_sr \<and> capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))}
 2. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?y'4141 immediate slota rv')
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4144 (from_bool expo) (cte_Ptr slot)) (?Q4141 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'4141 immediate slota (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. ?Q4141 immediate slota)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P4144 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s x. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s; invs' s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)
 2. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?y'4141 immediate slota rv')
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4144 (from_bool expo) (cte_Ptr slot)) (?Q4141 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'4141 immediate slota (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. ?Q4141 immediate slota)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P4144 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>s x cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; invs' s; (s, x) \<in> rf_sr; cteCap cte = cap\<rbrakk> \<Longrightarrow> isZombie (cteCap cte)
 2. \<And>s x capa ccap cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; invs' s; (s, x) \<in> rf_sr; capa = cteCap cte; ccap = h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])); cteCap cte = cap; ccap_relation capa ccap; capAligned capa; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift ccap) = capZombiePtr capa; capZombieType_CL (cap_zombie_cap_lift ccap) = (case capZombieType capa of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)
 3. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?y'4141 immediate slota rv')
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4144 (from_bool expo) (cte_Ptr slot)) (?Q4141 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'4141 immediate slota (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. ?Q4141 immediate slota)
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P4144 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s x capa ccap cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; invs' s; (s, x) \<in> rf_sr; capa = cteCap cte; ccap = h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])); cteCap cte = cap; ccap_relation capa ccap; capAligned capa; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift ccap) = capZombiePtr capa; capZombieType_CL (cap_zombie_cap_lift ccap) = (case capZombieType capa of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)
 2. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?y'4141 immediate slota rv')
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4144 (from_bool expo) (cte_Ptr slot)) (?Q4141 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'4141 immediate slota (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. ?Q4141 immediate slota)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P4144 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota rv' t t'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>type :== \<acute>ret__unsigned;;
(IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?y'4141 immediate slota rv')
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4144 (from_bool expo) (cte_Ptr slot)) (?Q4141 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (?y'4141 immediate slota (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. ?Q4141 immediate slota)
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P4144 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4144 (from_bool expo) (cte_Ptr slot)) (?Q4141 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (\<acute>type :== (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x);;
(IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = \<acute>type then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. ?Q4141 immediate slota)
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P4144 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4144 (from_bool expo) (cte_Ptr slot)) (?G'4440 immediate slota) [SKIP] (cutMon ((=) s) (reduceZombie cap slot expo)) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap) +\<^sub>p uint (word_of_nat (capZombieNumber cap) - 1))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> ?G'4440 immediate slota})
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P4144 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4144 (from_bool expo) (cte_Ptr slot)) (?G'4440 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (if capZombieNumber cap = 0 then haskell_fail [] else if isZombie cap \<and> \<not> expo then let ptr = capZombiePtr cap in doE haskell_assertE (ptr \<noteq> slot) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr slot
odE else if isZombie cap \<and> expo then let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE else haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> ?G'4440 immediate slota})
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P4144 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4144 (from_bool expo) (cte_Ptr slot)) (?G'4440 (from_bool expo) (cte_Ptr slot)) [SKIP] (if capZombieNumber cap = 0 then cutMon ((=) s) (haskell_fail []) else if True \<and> \<not> expo then cutMon ((=) s) (let ptr = capZombiePtr cap in doE haskell_assertE (ptr \<noteq> slot) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr slot
odE) else if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> ?G'4440 immediate slota})
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P4144 immediate slota and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap = 0\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4971 (from_bool expo) (cte_Ptr slot)) (?S4974 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4970 (from_bool expo) (cte_Ptr slot)) (?T4972 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> \<not> expo then cutMon ((=) s) (let ptr = capZombiePtr cap in doE haskell_assertE (ptr \<noteq> slot) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr slot
odE) else if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> ?S4974 immediate slota) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> ?T4972 immediate slota)}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> ?Q4971 immediate slota a) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> ?R4970 immediate slota a)) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4970 (from_bool expo) (cte_Ptr slot)) (?T4972 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> \<not> expo then cutMon ((=) s) (let ptr = capZombiePtr cap in doE haskell_assertE (ptr \<noteq> slot) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr slot
odE) else if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> ?T4972 immediate slota)}})
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> ?R4970 immediate slota a)) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; True \<and> \<not> expo\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5001 (from_bool expo) (cte_Ptr slot)) (?S5004 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (let ptr = capZombiePtr cap in doE haskell_assertE (ptr \<noteq> slot) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr slot
odE)) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> ?S5004 immediate slota) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)) (?S5004 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (do a <- assert (capZombiePtr cap \<noteq> slot);
capAtPtr <- liftM cteCap (getCTE (capZombiePtr cap));
doE a <- case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> capZombiePtr cap) [] | _ \<Rightarrow> returnOk ();
liftE (capSwapForDelete (capZombiePtr cap) slot)
odE
od)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> ?S5004 immediate slota) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)) (?S5004 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)) [SKIP] (do capAtPtr <- liftM cteCap (getCTE (capZombiePtr cap));
doE a <- case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> capZombiePtr cap) [] | _ \<Rightarrow> returnOk ();
liftE (capSwapForDelete (capZombiePtr cap) slot)
odE
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> ?S5004 immediate slota) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)) (?S5004 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)) [SKIP] (do capAtPtr <- liftM cteCap (getCTE (capZombiePtr cap));
doE a <- case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> capZombiePtr cap) [] | _ \<Rightarrow> returnOk ();
liftE (capSwapForDelete (capZombiePtr cap) slot)
odE
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
(CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> ?S5004 immediate slota) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)) (?S5004 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)) [SKIP] (do x <- getCTE (capZombiePtr cap);
a <- assert (case cteCap x of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True);
liftE (capSwapForDelete (capZombiePtr cap) slot)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
(CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> ?S5004 immediate slota) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5038 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) (?Q'5036 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) [SKIP] (do a <- assert (case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True);
liftE (capSwapForDelete (capZombiePtr cap) slot)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
(CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)\<rbrace> getCTE (capZombiePtr cap) \<lbrace>?Q5038 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)\<rbrace>
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q5038 immediate slota rv s \<longrightarrow> s' \<in> ?Q'5036 immediate slota rv}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5038 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) (?Q'5036 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) [SKIP] (liftE (capSwapForDelete (capZombiePtr cap) slot)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
(CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)\<rbrace> getCTE (capZombiePtr cap) \<lbrace>?Q5038 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)\<rbrace>
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q5038 immediate slota rv s \<longrightarrow> s' \<in> ?Q'5036 immediate slota rv}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A5050 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) (?C'5047 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) [SKIP] (liftE (capSwapForDelete (capZombiePtr cap) slot)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C''])));;
(CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)\<rbrace> getCTE (capZombiePtr cap) \<lbrace>\<lambda>a. ?A5050 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))\<rbrace>
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?A5050 immediate slota rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> ?C'5047 immediate slota rv \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A5050 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) (?Q'5053 immediate slota rv) [SKIP] (liftE (capSwapForDelete (capZombiePtr cap) slot)) (CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5047 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) (?Q'5053 immediate slota rv)
 3. \<And>immediate slota rv s. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True; ?A5050 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5047 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)\<rbrace> getCTE (capZombiePtr cap) \<lbrace>\<lambda>a. ?A5050 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))\<rbrace>
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?A5050 immediate slota rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> ?C'5047 immediate slota rv \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A5050 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) (?Q'5053 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) [SKIP] (do x <- capSwapForDelete (capZombiePtr cap) slot;
return (Inr ())
od) (CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5047 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) (?Q'5053 immediate slota rv)
 3. \<And>immediate slota rv s. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True; ?A5050 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5047 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)\<rbrace> getCTE (capZombiePtr cap) \<lbrace>\<lambda>a. ?A5050 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))\<rbrace>
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?A5050 immediate slota rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> ?C'5047 immediate slota rv \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>immediate slota rv rva xfdc. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5064 immediate slota rv rva) (?Q'5078 rv rva xfdc) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> \<lbrace>?R5072 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv\<rbrace> capSwapForDelete (capZombiePtr cap) slot \<lbrace>?Q5064 immediate slota rv\<rbrace>
 3. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5047 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) ({s. slot2_'_update (\<lambda>_. slota) (slot1_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap)) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot1 = cte_Ptr (capZombiePtr cap)\<rbrace> \<inter> \<lbrace>\<acute>slot2 = slota\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'5077 immediate slota rv t rva})
 4. \<And>immediate slota rv s. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True; (valid_mdb' and pspace_aligned' and ?R5072 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5047 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)\<rbrace> getCTE (capZombiePtr cap) \<lbrace>\<lambda>a. valid_mdb' and pspace_aligned' and ?R5072 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))\<rbrace>
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and ?R5072 immediate slota rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> ?C'5047 immediate slota rv \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>rv t rva. ?Q'5078 rv rva (xfdc t) \<equiv>\<^sup>? ?Q'5077 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) proof (prove)
goal (10 subgoals):
 1. \<And>immediate slota rv rva xfdc. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True; dc rva xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> \<lbrace>?R5072 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv\<rbrace> capSwapForDelete (capZombiePtr cap) slot \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5047 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) ({s. slot2_'_update (\<lambda>_. slota) (slot1_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap)) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot1 = cte_Ptr (capZombiePtr cap)\<rbrace> \<inter> \<lbrace>\<acute>slot2 = slota\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>immediate slota rv s. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True; (valid_mdb' and pspace_aligned' and ?R5072 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5047 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)\<rbrace> getCTE (capZombiePtr cap) \<lbrace>\<lambda>a. valid_mdb' and pspace_aligned' and ?R5072 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))\<rbrace>
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and ?R5072 immediate slota rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> ?C'5047 immediate slota rv \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>immediate slota rv rva xfdc \<sigma>. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True; dc rva xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> \<lbrace>?R5072 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv\<rbrace> capSwapForDelete (capZombiePtr cap) slot \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5047 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) ({s. slot2_'_update (\<lambda>_. slota) (slot1_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap)) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot1 = cte_Ptr (capZombiePtr cap)\<rbrace> \<inter> \<lbrace>\<acute>slot2 = slota\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 4. \<And>immediate slota rv s. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True; (valid_mdb' and pspace_aligned' and ?R5072 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5047 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)\<rbrace> getCTE (capZombiePtr cap) \<lbrace>\<lambda>a. valid_mdb' and pspace_aligned' and ?R5072 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))\<rbrace>
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and ?R5072 immediate slota rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> ?C'5047 immediate slota rv \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> \<lbrace>?R5072 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv\<rbrace> capSwapForDelete (capZombiePtr cap) slot \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5047 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) ({s. slot2_'_update (\<lambda>_. slota) (slot1_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap)) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot1 = cte_Ptr (capZombiePtr cap)\<rbrace> \<inter> \<lbrace>\<acute>slot2 = slota\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 3. \<And>immediate slota rv s. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True; (valid_mdb' and pspace_aligned' and ?R5072 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5047 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)\<rbrace> getCTE (capZombiePtr cap) \<lbrace>\<lambda>a. valid_mdb' and pspace_aligned' and ?R5072 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))\<rbrace>
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and ?R5072 immediate slota rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> ?C'5047 immediate slota rv \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>immediate slota rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5047 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) ({s. slot2_'_update (\<lambda>_. slota) (slot1_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap)) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot1 = cte_Ptr (capZombiePtr cap)\<rbrace> \<inter> \<lbrace>\<acute>slot2 = slota\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})
 2. \<And>immediate slota rv s. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True; (valid_mdb' and pspace_aligned' and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5047 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot) rv \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)\<rbrace> getCTE (capZombiePtr cap) \<lbrace>\<lambda>a. valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))\<rbrace>
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> ?C'5047 immediate slota rv \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>immediate slota rv s. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True; (valid_mdb' and pspace_aligned' and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>True\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)\<rbrace> getCTE (capZombiePtr cap) \<lbrace>\<lambda>a. valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))\<rbrace>
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>immediate slota rv s. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot; case cteCap rv of capability.Zombie ptr2 x xa \<Rightarrow> ptr2 \<noteq> capZombiePtr cap | _ \<Rightarrow> True; (valid_mdb' and pspace_aligned' and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<lbrace>True\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C''])))\<rparr>) \<in> rf_sr}
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)\<rbrace> getCTE (capZombiePtr cap) \<lbrace>\<lambda>a. valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))\<rbrace>
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) false; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; \<not> expo; capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> \<lbrace>?Q5001 (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr slot)\<rbrace> getCTE (capZombiePtr cap) \<lbrace>\<lambda>a. valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))\<rbrace>
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> ?Q5001 immediate slota a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5000 (from_bool expo) (cte_Ptr slot)) (?T5002 (from_bool expo) (cte_Ptr slot)) [SKIP] (if True \<and> expo then cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE) else cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> ?T5002 immediate slota)})}})
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> ?R5000 immediate slota a))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); True \<and> expo\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5179 (from_bool expo) (cte_Ptr slot)) (?S5182 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (let z = cap; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
cteDelete endSlot False;
ourCTE <- withoutPreemption $ getCTE slot;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> ptr \<noteq> slot) [] else haskell_fail []
odE)) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> ?S5182 immediate slota) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ?Q5179 immediate slota a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5179 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)) (?S5182 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (do endSlot <- locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1);
doE a <- cteDelete endSlot False;
do ourCTE <- getCTE slot;
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then let ptr2 = capZombiePtr (cteCap ourCTE) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []
od
odE
od)) (IF True THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> ?S5182 immediate slota) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ?Q5179 immediate slota a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5200 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)) (?Q'5198 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (doE a <- cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False;
do ourCTE <- getCTE slot;
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then let ptr2 = capZombiePtr (cteCap ourCTE) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []
od
odE)) (IF True THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> ?Q'5198 immediate slota}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> (?Q5200 immediate slota and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5200 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)) (?Q'5198 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)) [SKIP] (doE rv <- cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False);
cutMon (\<lambda>s'. (Inr (), s') \<in> fst (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False s)) (do ourCTE <- getCTE slot;
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then let ptr2 = capZombiePtr (cteCap ourCTE) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []
od)
odE) (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> ?Q'5198 immediate slota}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> (?Q5200 immediate slota and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A5237 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)) (?C'5241 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)) [SKIP] (doE rv <- cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False);
cutMon (\<lambda>s'. (Inr (), s') \<in> fst (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False s)) (do ourCTE <- getCTE slot;
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then let ptr2 = capZombiePtr (cteCap ourCTE) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []
od)
odE) (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)));;
(\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> ?C'5241 immediate slota \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> (?A5237 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A5237 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)) (?G'5253 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)) [SKIP] (doE rv <- cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False);
cutMon (\<lambda>s'. (Inr (), s') \<in> fst (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False s)) (do ourCTE <- getCTE slot;
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then let ptr2 = capZombiePtr (cteCap ourCTE) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []
od)
odE) (\<acute>status :== CALL cteDelete_'proc(cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))),SCAST(32 signed \<rightarrow> 32) false);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> ?G'5253 immediate slota} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> (?A5237 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, cap) (success', cap'). success' = from_bool success \<and> ccap_relation cap cap' \<and> cleanup_info_wf' cap)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (\<lambda>s. invs' s \<and> sch_act_simple s \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) s)) (UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool False\<rbrace>) [] (cutMon ((=) s) (finaliseSlot (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False)) (Call finaliseSlot_'proc)
 2. \<And>immediate slota rv status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); dc rv (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5696 immediate slota rv) (?Q'5717 rv status) [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False s)) (do ourCTE <- getCTE slot;
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then let ptr2 = capZombiePtr (cteCap ourCTE) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []
od)) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. status)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>?Q5696 immediate slota\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q'5716 immediate slota t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>t rv. ?Q'5717 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? ?Q'5716 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (10 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> (\<lambda>(success, cap) (success', cap'). success' = from_bool success \<and> ccap_relation cap cap' \<and> cleanup_info_wf' cap)) (liftxf errstate finaliseSlot_ret_C.status_C (\<lambda>v. (finaliseSlot_ret_C.success_C v, finaliseSlot_ret_C.cleanupInfo_C v)) ret__struct_finaliseSlot_ret_C_') (?Q6244 immediate slota) (?Q'6244 immediate slota) [] (cutMon ((=) s) (finaliseSlot (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False)) (Call finaliseSlot_'proc)
 2. \<And>immediate slota sa s'. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); (sa, s') \<in> rf_sr; invs' sa \<and> sch_act_simple sa \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) sa); s' \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool False\<rbrace>\<rbrakk> \<Longrightarrow> ?Q6244 immediate slota sa \<and> s' \<in> ?Q'6244 immediate slota
 3. \<And>immediate slota rv status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); dc rv (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5696 immediate slota rv) (?Q'5717 rv status) [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False s)) (do ourCTE <- getCTE slot;
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then let ptr2 = capZombiePtr (cteCap ourCTE) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []
od)) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. status)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 4. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>?Q5696 immediate slota\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q'5716 immediate slota t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>t rv. ?Q'5717 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? ?Q'5716 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (9 subgoals):
 1. \<And>immediate slota sa s'. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); (sa, s') \<in> rf_sr; invs' sa \<and> sch_act_simple sa \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) sa); s' \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool False\<rbrace>\<rbrakk> \<Longrightarrow> (invs' sa \<and> sch_act_simple sa \<and> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) sa) \<and> s' \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>immediate = from_bool False\<rbrace>
 2. \<And>immediate slota rv status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); dc rv (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5696 immediate slota rv) (?Q'5717 rv status) [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False s)) (do ourCTE <- getCTE slot;
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then let ptr2 = capZombiePtr (cteCap ourCTE) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []
od)) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. status)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>?Q5696 immediate slota\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q'5716 immediate slota t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>t rv. ?Q'5717 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? ?Q'5716 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (8 subgoals):
 1. \<And>immediate slota rv status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); dc rv (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5696 immediate slota rv) (?Q'5717 rv status) [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False s)) (do ourCTE <- getCTE slot;
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then let ptr2 = capZombiePtr (cteCap ourCTE) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []
od)) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. status)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>?Q5696 immediate slota\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q'5716 immediate slota t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>t rv. ?Q'5717 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? ?Q'5716 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (8 subgoals):
 1. \<And>immediate slota rv status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); dc rv (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5696 immediate slota rv) (?Q'5717 rv status) [SKIP] (do ourCTE <- getCTE slot;
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then let ptr2 = capZombiePtr (cteCap ourCTE) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []
od) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. status)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>?Q5696 immediate slota\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q'5716 immediate slota t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>t rv. ?Q'5717 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? ?Q'5716 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (8 subgoals):
 1. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5696 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()) (?Q'5717 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (do ourCTE <- getCTE slot;
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then let ptr2 = capZombiePtr (cteCap ourCTE) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>?Q5696 immediate slota\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q'5716 immediate slota t rv)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>t rv. ?Q'5717 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? ?Q'5716 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (8 subgoals):
 1. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()) (?C'6260 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (do ourCTE <- getCTE slot;
if cteCap ourCTE = capability.NullCap then returnOk () else if isZombie (cteCap ourCTE) then let ptr2 = capZombiePtr (cteCap ourCTE) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []
od) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?C'6262 immediate slota t rv \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
?C'6262 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?C'6260 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (9 subgoals):
 1. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6280 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q'6278 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>?Q6280 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 3. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ?Q6283 immediate slota t rv rva s \<longrightarrow> s' \<in> ?Q'6282 immediate slota t rv rva} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
?Q6283 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q6280 rv (ret__unsigned_long_' t)
?Q'6282 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q'6278 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (12 subgoals):
 1. \<And>immediate slota status rv sa. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. cte_wp_at' ((=) rv) slot sa \<and> (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) ({s'. (sa, s') \<in> rf_sr} \<inter> \<lbrace>\<exists>cp. ccap_relation (cteCap rv) cp \<and> \<acute>ret__unsigned = cap_get_tag cp\<rbrace>)
 2. \<And>immediate slota status rv rv' t t'. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'6286 immediate slota status rv rv')
 3. \<And>immediate slota status rv rv'. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q6286 immediate slota status rv rv') [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (?y'6286 immediate slota status rv rv')
 4. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva. ?Q6286 immediate slota status rv)
 5. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. ?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' ((=) a) slot\<rbrace>
 6. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P6292 immediate slota t rv rva and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
A total of 12 subgoals...
flex-flex pairs:
\<lambda>t rv. ?P6290 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? ?P6292 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (12 subgoals):
 1. \<And>immediate slota status rv sa. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. cte_wp_at' ((=) rv) slot sa \<and> (sa, s') \<in> rf_sr} \<subseteq> {s. \<forall>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<longrightarrow> (sa, s\<lparr>ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))\<rparr>) \<in> rf_sr \<and> (\<exists>cp. ccap_relation (cteCap rv) cp \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = cap_get_tag cp)}
 2. \<And>immediate slota status rv rv' t t'. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'6286 immediate slota status rv rv')
 3. \<And>immediate slota status rv rv'. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q6286 immediate slota status rv rv') [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (?y'6286 immediate slota status rv rv')
 4. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva. ?Q6286 immediate slota status rv)
 5. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. ?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' ((=) a) slot\<rbrace>
 6. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P6292 immediate slota t rv rva and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
A total of 12 subgoals...
flex-flex pairs:
?P6292 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6290 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (12 subgoals):
 1. \<And>rv sa x t. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ctes_of sa slot = Some rv; (sa, x) \<in> rf_sr; ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> \<exists>cp. ccap_relation (cteCap rv) cp \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = cap_get_tag cp
 2. \<And>immediate slota status rv rv' t t'. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'6286 immediate slota status rv rv')
 3. \<And>immediate slota status rv rv'. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q6286 immediate slota status rv rv') [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (?y'6286 immediate slota status rv rv')
 4. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva. ?Q6286 immediate slota status rv)
 5. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. ?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' ((=) a) slot\<rbrace>
 6. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P6292 immediate slota t rv rva and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
A total of 12 subgoals...
flex-flex pairs:
?P6292 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6290 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (12 subgoals):
 1. \<And>rv sa x t y'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ctes_of sa slot = Some rv; ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); ctes_of sa slot = Some rv; ccte_relation rv y'; cslift x (cte_Ptr slot) = Some y'\<rbrakk> \<Longrightarrow> \<exists>cp. ccap_relation (cteCap rv) cp \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = cap_get_tag cp
 2. \<And>immediate slota status rv rv' t t'. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'6286 immediate slota status rv rv')
 3. \<And>immediate slota status rv rv'. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q6286 immediate slota status rv rv') [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (?y'6286 immediate slota status rv rv')
 4. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva. ?Q6286 immediate slota status rv)
 5. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. ?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' ((=) a) slot\<rbrace>
 6. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P6292 immediate slota t rv rva and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
A total of 12 subgoals...
flex-flex pairs:
?P6292 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6290 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (12 subgoals):
 1. \<And>rv sa x t y'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ret__unsigned_' t = cap_get_tag (cte_C.cap_C y'); ctes_of sa slot = Some rv; cslift x (cte_Ptr slot) = Some y'; ccap_relation (cteCap rv) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>cp. ccap_relation (cteCap rv) cp \<and> cap_get_tag (cte_C.cap_C y') = cap_get_tag cp
 2. \<And>immediate slota status rv rv' t t'. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'6286 immediate slota status rv rv')
 3. \<And>immediate slota status rv rv'. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q6286 immediate slota status rv rv') [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (?y'6286 immediate slota status rv rv')
 4. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva. ?Q6286 immediate slota status rv)
 5. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. ?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' ((=) a) slot\<rbrace>
 6. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P6292 immediate slota t rv rva and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
A total of 12 subgoals...
flex-flex pairs:
?P6292 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6290 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (11 subgoals):
 1. \<And>immediate slota status rv rv' t t'. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'6286 immediate slota status rv rv')
 2. \<And>immediate slota status rv rv'. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q6286 immediate slota status rv rv') [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (?y'6286 immediate slota status rv rv')
 3. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva. ?Q6286 immediate slota status rv)
 4. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. ?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' ((=) a) slot\<rbrace>
 5. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P6292 immediate slota t rv rva and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals...
flex-flex pairs:
?P6292 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6290 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (10 subgoals):
 1. \<And>immediate slota status rv rv'. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q6286 immediate slota status rv rv') [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (IF rv' = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF rv' = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva. ?Q6286 immediate slota status rv)
 3. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. ?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' ((=) a) slot\<rbrace>
 4. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P6292 immediate slota t rv rva and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
?P6292 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6290 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (10 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q6286 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (IF cteCap rv = capability.NullCap THEN
  SKIP
ELSE
  IF isZombie (cteCap rv) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva. ?Q6286 immediate slota status rv)
 3. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. ?P6290 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' ((=) a) slot\<rbrace>
 4. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P6292 immediate slota t rv rva and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
?P6292 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6290 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (11 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6674 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S6678 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6673 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6677 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (IF isZombie (cteCap rv) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> ?S6678 immediate slota status rv a) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> ?T6677 immediate slota status rv a)})
 4. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> ?Q6674 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> ?R6673 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b)) and cte_wp_at' ((=) a) slot\<rbrace>
 5. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> ?Q6676 immediate slota t rv rva a) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> ?R6675 immediate slota t rv rva a)) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals...
flex-flex pairs:
?Q6676 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q6674 rv (ret__unsigned_long_' t)
?R6675 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6673 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (11 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation capability.NullCap cp; cteCap rv = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6674 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S6678 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6673 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6677 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (IF isZombie (cteCap rv) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> ?S6678 immediate slota status rv a) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> ?T6677 immediate slota status rv a)})
 4. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> ?Q6674 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> ?R6673 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b)) and cte_wp_at' ((=) a) slot\<rbrace>
 5. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> ?Q6676 immediate slota t rv rva a) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> ?R6675 immediate slota t rv rva a)) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals...
flex-flex pairs:
?Q6676 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q6674 rv (ret__unsigned_long_' t)
?R6675 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6673 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (11 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation capability.NullCap cp; cteCap rv = capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (returnOk () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6673 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6677 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (IF isZombie (cteCap rv) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> ?T6677 immediate slota status rv a)})
 4. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> ?R6673 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b)) and cte_wp_at' ((=) a) slot\<rbrace>
 5. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> ?R6675 immediate slota t rv rva a)) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals...
flex-flex pairs:
?R6675 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6673 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (11 subgoals):
 1. \<And>rv cp \<sigma>. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation capability.NullCap cp; cteCap rv = capability.NullCap\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (returnOk () \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6673 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6677 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (IF isZombie (cteCap rv) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> ?T6677 immediate slota status rv a)})
 4. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> ?R6673 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b)) and cte_wp_at' ((=) a) slot\<rbrace>
 5. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> ?R6675 immediate slota t rv rva a)) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals...
flex-flex pairs:
?R6675 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6673 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (10 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6673 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6677 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (IF isZombie (cteCap rv) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> ?T6677 immediate slota status rv a)})
 3. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> ?R6673 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b)) and cte_wp_at' ((=) a) slot\<rbrace>
 4. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> ?R6675 immediate slota t rv rva a)) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
?R6675 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6673 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (11 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6705 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S6709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> ?S6709 immediate slota status rv a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 4. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ?Q6705 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 5. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ?Q6707 immediate slota t rv rva a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals...
flex-flex pairs:
?Q6707 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q6705 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (11 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6705 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S6709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> ?S6709 immediate slota status rv a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 4. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ?Q6705 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 5. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ?Q6707 immediate slota t rv rva a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals...
flex-flex pairs:
?Q6707 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q6705 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (11 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A6735 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?C'6732 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])));;
(\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
(\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> ?C'6732 immediate slota status rv a \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 4. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> (?A6735 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 5. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> (?A6737 immediate slota t rv rva and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
A total of 11 subgoals...
flex-flex pairs:
?A6737 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A6735 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (14 subgoals):
 1. \<And>rv cp sa. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (cte_wp_at' ((=) rv) slot and invs') sa \<and> (sa, s') \<in> rf_sr}) \<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) ({s'. (sa, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned_long = capZombiePtr (cteCap rv)\<rbrace>)
 2. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
(\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?y'6739 rv cp rv')
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q6739 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'6739 rv cp (capZombiePtr (cteCap rv)))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. ?Q6739 rv cp)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 7. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 8. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>t rv. ?P6743 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? ?P6745 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (14 subgoals):
 1. \<And>rv cp sa. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. (cte_wp_at' ((=) rv) slot and invs') sa \<and> (sa, s') \<in> rf_sr} \<subseteq> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> get_capZombieBits_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 0x1F \<and> (\<forall>t. ret__unsigned_long_' t = get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (sa, s\<lparr>ret__unsigned_long_' := get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))\<rparr>) \<in> rf_sr \<and> get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap rv))}
 2. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
(\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?y'6739 rv cp rv')
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q6739 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'6739 rv cp (capZombiePtr (cteCap rv)))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. ?Q6739 rv cp)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 7. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 8. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 14 subgoals...
flex-flex pairs:
?P6745 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6743 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (14 subgoals):
 1. \<And>rv cp sa x. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_wp_at' ((=) rv) slot sa; invs' sa; (sa, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> get_capZombieBits_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 0x1F \<and> ((\<exists>t. ret__unsigned_long_' t = get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) \<longrightarrow> get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap rv))
 2. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
(\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?y'6739 rv cp rv')
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q6739 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'6739 rv cp (capZombiePtr (cteCap rv)))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. ?Q6739 rv cp)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 7. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 8. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 14 subgoals...
flex-flex pairs:
?P6745 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6743 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (15 subgoals):
 1. \<And>rv cp sa x cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); invs' sa; (sa, x) \<in> rf_sr; rv = cte\<rbrakk> \<Longrightarrow> isZombie (cteCap cte)
 2. \<And>rv cp sa x capa ccap cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); invs' sa; (sa, x) \<in> rf_sr; capa = cteCap cte; ccap = h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])); rv = cte; ccap_relation capa ccap; capAligned capa; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift ccap) = capZombiePtr capa; capZombieType_CL (cap_zombie_cap_lift ccap) = (case capZombieType capa of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> get_capZombieBits_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 0x1F \<and> ((\<exists>t. ret__unsigned_long_' t = get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) \<longrightarrow> get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap rv))
 3. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
(\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?y'6739 rv cp rv')
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q6739 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'6739 rv cp (capZombiePtr (cteCap rv)))
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. ?Q6739 rv cp)
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 8. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 9. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
?P6745 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6743 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (14 subgoals):
 1. \<And>rv cp sa x capa ccap cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); invs' sa; (sa, x) \<in> rf_sr; capa = cteCap cte; ccap = h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])); rv = cte; ccap_relation capa ccap; capAligned capa; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift ccap) = capZombiePtr capa; capZombieType_CL (cap_zombie_cap_lift ccap) = (case capZombieType capa of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> get_capZombieBits_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) < 0x1F \<and> ((\<exists>t. ret__unsigned_long_' t = get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) \<longrightarrow> get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap rv))
 2. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
(\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?y'6739 rv cp rv')
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q6739 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'6739 rv cp (capZombiePtr (cteCap rv)))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. ?Q6739 rv cp)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 7. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 8. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 14 subgoals...
flex-flex pairs:
?P6745 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6743 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (13 subgoals):
 1. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
(\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?y'6739 rv cp rv')
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q6739 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'6739 rv cp (capZombiePtr (cteCap rv)))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. ?Q6739 rv cp)
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 6. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 7. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> (?P6745 immediate slota t rv rva and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
A total of 13 subgoals...
flex-flex pairs:
?P6745 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6743 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (12 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q6739 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (\<acute>ptr2 :== cte_Ptr (capZombiePtr (cteCap rv));;
(\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. ?Q6739 rv cp)
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 5. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 6. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> (?P6745 immediate slota t rv rva and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
A total of 12 subgoals...
flex-flex pairs:
?P6745 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6743 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (12 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?G'6933 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> ?G'6933 rv cp})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 5. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 6. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> (?P6745 immediate slota t rv rva and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
A total of 12 subgoals...
flex-flex pairs:
?P6745 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6743 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (12 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?G'7252 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (IF (if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> ?G'7252 rv cp}})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 5. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 6. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> (?P6745 immediate slota t rv rva and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
A total of 12 subgoals...
flex-flex pairs:
?P6745 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6743 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (12 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?G'7252 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (IF cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> ?G'7252 rv cp}})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 5. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> (?P6743 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 6. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> (?P6745 immediate slota t rv rva and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
A total of 12 subgoals...
flex-flex pairs:
?P6745 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P6743 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (13 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7389 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T7388 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S7388 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> ?S7388 rv cp) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> ?T7388 rv cp)}}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 6. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ?R7389 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 7. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ?Q7392 immediate slota t rv rva a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ?R7391 immediate slota t rv rva a)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
A total of 13 subgoals...
flex-flex pairs:
?Q7392 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q7390 rv (ret__unsigned_long_' t)
?R7391 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R7389 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (13 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap \<noteq> capZombiePtr (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7389 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T7388 rv cp) [SKIP] (do r <- assert (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot);
return (Inr ())
od) (IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S7388 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> ?S7388 rv cp) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> ?T7388 rv cp)}}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 6. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ?R7389 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 7. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ?Q7392 immediate slota t rv rva a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ?R7391 immediate slota t rv rva a)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
A total of 13 subgoals...
flex-flex pairs:
?Q7392 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q7390 rv (ret__unsigned_long_' t)
?R7391 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R7389 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (13 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap \<noteq> capZombiePtr (cteCap rv); capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7389 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T7388 rv cp) [SKIP] (return (Inr ())) (IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S7388 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> ?S7388 rv cp) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> ?T7388 rv cp)}}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 6. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ?R7389 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 7. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ?Q7392 immediate slota t rv rva a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ?R7391 immediate slota t rv rva a)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
A total of 13 subgoals...
flex-flex pairs:
?Q7392 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q7390 rv (ret__unsigned_long_' t)
?R7391 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R7389 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (13 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7389 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?R'7416 rv cp) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S7388 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> ?S7388 rv cp) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> ?R'7416 rv cp \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 6. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ?R7389 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 7. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ?Q7392 immediate slota t rv rva a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ?R7391 immediate slota t rv rva a)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
A total of 13 subgoals...
flex-flex pairs:
?Q7392 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q7390 rv (ret__unsigned_long_' t)
?R7391 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R7389 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (13 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S7388 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> ?S7388 rv cp) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 6. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 7. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ?Q7392 immediate slota t rv rva a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> True)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
A total of 13 subgoals...
flex-flex pairs:
?Q7392 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q7390 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (13 subgoals):
 1. \<And>rv cp \<sigma>. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S7388 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> ?S7388 rv cp) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 6. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 7. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ?Q7392 immediate slota t rv rva a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> True)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
A total of 13 subgoals...
flex-flex pairs:
?Q7392 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q7390 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (12 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S7388 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> ?S7388 rv cp) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 5. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 6. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ?Q7392 immediate slota t rv rva a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> True)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
A total of 12 subgoals...
flex-flex pairs:
?Q7392 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q7390 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (12 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S7388 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> ?S7388 rv cp) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 5. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ?Q7390 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 6. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ?Q7392 immediate slota t rv rva a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> True)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
A total of 12 subgoals...
flex-flex pairs:
?Q7392 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q7390 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (12 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A7440 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?C'7437 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> ?C'7437 rv cp \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 5. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> (?A7440 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 6. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> (?A7442 immediate slota t rv rva and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> True)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
A total of 12 subgoals...
flex-flex pairs:
?A7442 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A7440 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (15 subgoals):
 1. \<And>rv cp sa. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (cte_wp_at' ((=) rv) slot and invs') sa \<and> (sa, s') \<in> rf_sr}) \<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) ({s'. (sa, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned_long = word_of_nat (capZombieNumber (cteCap rv))\<rbrace>)
 2. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?y'7444 rv cp rv')
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q7444 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'7444 rv cp (word_of_nat (capZombieNumber (cteCap rv))))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. ?Q7444 rv cp)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 8. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 9. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>t rv. ?P7448 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? ?P7450 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (15 subgoals):
 1. \<And>rv cp sa. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. (cte_wp_at' ((=) rv) slot and invs') sa \<and> (sa, s') \<in> rf_sr} \<subseteq> {s. \<exists>cap. ccap_relation cap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> isZombie cap \<and> capAligned cap \<and> (\<forall>t. ret__unsigned_long_' t = word_of_nat (capZombieNumber cap) \<longrightarrow> (sa, s\<lparr>ret__unsigned_long_' := word_of_nat (capZombieNumber cap)\<rparr>) \<in> rf_sr \<and> word_of_nat (capZombieNumber cap) = word_of_nat (capZombieNumber (cteCap rv)))}
 2. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?y'7444 rv cp rv')
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q7444 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'7444 rv cp (word_of_nat (capZombieNumber (cteCap rv))))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. ?Q7444 rv cp)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 8. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 9. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
?P7450 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7448 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (15 subgoals):
 1. \<And>rv cp sa x. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap = capZombiePtr (cteCap rv); cte_wp_at' ((=) rv) slot sa; invs' sa; (sa, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<exists>cap. ccap_relation cap (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> isZombie cap \<and> capAligned cap \<and> ((\<exists>t. ret__unsigned_long_' t = word_of_nat (capZombieNumber cap)) \<longrightarrow> word_of_nat (capZombieNumber cap) = word_of_nat (capZombieNumber (cteCap rv)))
 2. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?y'7444 rv cp rv')
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q7444 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'7444 rv cp (word_of_nat (capZombieNumber (cteCap rv))))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. ?Q7444 rv cp)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 8. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 9. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
?P7450 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7448 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (16 subgoals):
 1. \<And>rv cp sa x cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap = capZombiePtr (cteCap rv); invs' sa; (sa, x) \<in> rf_sr; rv = cte\<rbrakk> \<Longrightarrow> isZombie (cteCap cte)
 2. \<And>rv cp sa x capa ccap cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap = capZombiePtr (cteCap rv); invs' sa; (sa, x) \<in> rf_sr; capa = cteCap cte; ccap = h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])); rv = cte; ccap_relation capa ccap; capAligned capa; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift ccap) = capZombiePtr capa; capZombieType_CL (cap_zombie_cap_lift ccap) = (case capZombieType capa of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> \<exists>cap. ccap_relation cap (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> isZombie cap \<and> capAligned cap \<and> ((\<exists>t. ret__unsigned_long_' t = word_of_nat (capZombieNumber cap)) \<longrightarrow> word_of_nat (capZombieNumber cap) = word_of_nat (capZombieNumber (cteCap rv)))
 3. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?y'7444 rv cp rv')
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q7444 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'7444 rv cp (word_of_nat (capZombieNumber (cteCap rv))))
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. ?Q7444 rv cp)
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 9. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 10. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 16 subgoals...
flex-flex pairs:
?P7450 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7448 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (15 subgoals):
 1. \<And>rv cp sa x capa ccap cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap = capZombiePtr (cteCap rv); invs' sa; (sa, x) \<in> rf_sr; capa = cteCap cte; ccap = h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])); rv = cte; ccap_relation capa ccap; capAligned capa; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift ccap) = capZombiePtr capa; capZombieType_CL (cap_zombie_cap_lift ccap) = (case capZombieType capa of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> \<exists>cap. ccap_relation cap (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> isZombie cap \<and> capAligned cap \<and> ((\<exists>t. ret__unsigned_long_' t = word_of_nat (capZombieNumber cap)) \<longrightarrow> word_of_nat (capZombieNumber cap) = word_of_nat (capZombieNumber (cteCap rv)))
 2. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?y'7444 rv cp rv')
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q7444 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'7444 rv cp (word_of_nat (capZombieNumber (cteCap rv))))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. ?Q7444 rv cp)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 8. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 9. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
?P7450 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7448 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (14 subgoals):
 1. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?y'7444 rv cp rv')
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q7444 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'7444 rv cp (word_of_nat (capZombieNumber (cteCap rv))))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. ?Q7444 rv cp)
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 7. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 8. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 14 subgoals...
flex-flex pairs:
?P7450 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7448 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (13 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q7444 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (\<acute>ret__int :== (if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. ?Q7444 rv cp)
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 6. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 7. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> (?P7450 immediate slota t rv rva and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> True)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
A total of 13 subgoals...
flex-flex pairs:
?P7450 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7448 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (13 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?G'7720 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (IF (if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> ?G'7720 rv cp})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 6. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 7. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> (?P7450 immediate slota t rv rva and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> True)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
A total of 13 subgoals...
flex-flex pairs:
?P7450 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7448 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (13 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?G'7720 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (IF word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> ?G'7720 rv cp})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 6. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> (?P7448 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 7. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> (?P7450 immediate slota t rv rva and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> True)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
A total of 13 subgoals...
flex-flex pairs:
?P7450 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7448 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (14 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7847 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T7846 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7848 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S7846 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> ?S7846 rv cp) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> ?T7846 rv cp)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 7. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ?Q7848 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ?R7847 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 8. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 14 subgoals...
flex-flex pairs:
?Q7850 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q7848 rv (ret__unsigned_long_' t)
?R7849 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R7847 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (14 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap); \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G7858 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T7846 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7848 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S7846 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> ?S7846 rv cp) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> ?T7846 rv cp)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 7. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ?Q7848 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> (?G7858 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 8. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>t rv. ?G7858 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? ?G7860 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)
?Q7850 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q7848 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (14 subgoals):
 1. \<And>rv cp sa. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap = capZombiePtr (cteCap rv); capZombieNumber (cteCap rv) \<noteq> capZombieNumber cap; valid_cap' (cteCap rv) sa; valid_cap' cap sa\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G7858 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T7846 rv cp) [SKIP] (assertE False) (IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7848 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S7846 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> ?S7846 rv cp) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> ?T7846 rv cp)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 7. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ?Q7848 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> (?G7858 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 8. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 14 subgoals...
flex-flex pairs:
?G7860 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?G7858 rv (ret__unsigned_long_' t)
?Q7850 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q7848 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (14 subgoals):
 1. \<And>rv cp sa. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap = capZombiePtr (cteCap rv); capZombieNumber (cteCap rv) \<noteq> capZombieNumber cap; valid_cap' (cteCap rv) sa; valid_cap' cap sa\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G7858 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T7846 rv cp) [SKIP] fail (IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7848 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S7846 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> ?S7846 rv cp) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> ?T7846 rv cp)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 7. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ?Q7848 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> (?G7858 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 8. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 14 subgoals...
flex-flex pairs:
?G7860 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?G7858 rv (ret__unsigned_long_' t)
?Q7850 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q7848 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (13 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7848 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S7846 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> ?S7846 rv cp) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 6. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ?Q7848 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 7. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rva)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ?Q7850 immediate slota t rv rva a) \<and> (word_of_nat (capZombieNumber (cteCap rva)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rva) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> True)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
A total of 13 subgoals...
flex-flex pairs:
?Q7850 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q7848 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (13 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7848 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S7846 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> ?S7846 rv cp) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 6. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ?Q7848 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 7. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rva)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ?Q7850 immediate slota t rv rva a) \<and> (word_of_nat (capZombieNumber (cteCap rva)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rva) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> True)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
A total of 13 subgoals...
flex-flex pairs:
?Q7850 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q7848 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (13 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A7881 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?C'7878 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> ?C'7878 rv cp \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 6. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> (?A7881 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 7. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rva)) = word_of_nat (capZombieNumber cap) \<longrightarrow> (?A7883 immediate slota t rv rva and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rva)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rva) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> True)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
A total of 13 subgoals...
flex-flex pairs:
?A7883 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A7881 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (16 subgoals):
 1. \<And>rv cp sa. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (cte_wp_at' ((=) rv) slot and invs') sa \<and> (sa, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) ({s'. (sa, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrace>)
 2. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?y'7885 rv cp rv')
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q7885 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'7885 rv cp (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. ?Q7885 rv cp)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 9. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 10. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 16 subgoals...
flex-flex pairs:
\<lambda>t rv. ?P7889 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? ?P7891 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (16 subgoals):
 1. \<And>rv cp sa. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. (cte_wp_at' ((=) rv) slot and invs') sa \<and> (sa, s') \<in> rf_sr} \<subseteq> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> (\<forall>t. ret__unsigned_' t = capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (sa, s\<lparr>ret__unsigned_' := capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))\<rparr>) \<in> rf_sr \<and> capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))}
 2. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?y'7885 rv cp rv')
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q7885 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'7885 rv cp (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. ?Q7885 rv cp)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 9. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 10. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 16 subgoals...
flex-flex pairs:
?P7891 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7889 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (16 subgoals):
 1. \<And>rv cp sa x. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap = capZombiePtr (cteCap rv); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); cte_wp_at' ((=) rv) slot sa; invs' sa; (sa, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> ((\<exists>t. ret__unsigned_' t = capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) \<longrightarrow> capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))
 2. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?y'7885 rv cp rv')
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q7885 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'7885 rv cp (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. ?Q7885 rv cp)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 9. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 10. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 16 subgoals...
flex-flex pairs:
?P7891 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7889 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (17 subgoals):
 1. \<And>rv cp sa x cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap = capZombiePtr (cteCap rv); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); invs' sa; (sa, x) \<in> rf_sr; rv = cte\<rbrakk> \<Longrightarrow> isZombie (cteCap cte)
 2. \<And>rv cp sa x capa ccap cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap = capZombiePtr (cteCap rv); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); invs' sa; (sa, x) \<in> rf_sr; capa = cteCap cte; ccap = h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])); rv = cte; ccap_relation capa ccap; capAligned capa; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift ccap) = capZombiePtr capa; capZombieType_CL (cap_zombie_cap_lift ccap) = (case capZombieType capa of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> ((\<exists>t. ret__unsigned_' t = capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) \<longrightarrow> capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))
 3. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?y'7885 rv cp rv')
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q7885 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'7885 rv cp (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. ?Q7885 rv cp)
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 10. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
?P7891 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7889 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (16 subgoals):
 1. \<And>rv cp sa x capa ccap cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap = capZombiePtr (cteCap rv); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); invs' sa; (sa, x) \<in> rf_sr; capa = cteCap cte; ccap = h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])); rv = cte; ccap_relation capa ccap; capAligned capa; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift ccap) = capZombiePtr capa; capZombieType_CL (cap_zombie_cap_lift ccap) = (case capZombieType capa of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> ((\<exists>t. ret__unsigned_' t = capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) \<longrightarrow> capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))
 2. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?y'7885 rv cp rv')
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q7885 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'7885 rv cp (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. ?Q7885 rv cp)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 9. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 10. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 16 subgoals...
flex-flex pairs:
?P7891 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7889 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv_) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv_) cp_; cteCap rv_ \<noteq> capability.NullCap; isZombie (cteCap rv_); capZombiePtr cap = capZombiePtr (cteCap rv_); word_of_nat (capZombieNumber (cteCap rv_)) = word_of_nat (capZombieNumber cap); invs' sa_; (sa_, x_) \<in> rf_sr; capa_ = cteCap cte_; ccap_ = h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])); rv_ = cte_; ccap_relation capa_ ccap_; capAligned capa_; cap_get_tag ccap_ = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift ccap_) = capZombiePtr capa_; capZombieType_CL (cap_zombie_cap_lift ccap_) = (case capZombieType capa_ of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<and> ((\<exists>t. ret__unsigned_' t = capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) \<longrightarrow> capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap rv_) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) proof (prove)
goal (15 subgoals):
 1. \<And>rv cp rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?y'7885 rv cp rv')
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q7885 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (?y'7885 rv cp (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. ?Q7885 rv cp)
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 8. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 9. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
?P7891 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7889 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (14 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q7885 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (\<acute>ret__int :== (if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. ?Q7885 rv cp)
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 7. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 8. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 14 subgoals...
flex-flex pairs:
?P7891 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7889 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (14 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?G'8064 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (IF (if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> ?G'8064 rv cp})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 7. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 8. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 14 subgoals...
flex-flex pairs:
?P7891 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7889 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (14 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?G'8064 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (IF (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> ?G'8064 rv cp})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 7. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>b. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>b. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>b. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> (?P7889 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) b)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) b) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a b))) and cte_wp_at' ((=) a) slot\<rbrace>
 8. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 14 subgoals...
flex-flex pairs:
?P7891 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?P7889 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (15 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8201 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?S8199 rv cp) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 8. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?Q8201 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 9. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
?Q8203 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?Q8201 rv (ret__unsigned_long_' t)
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (15 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?S8199 rv cp) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 8. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 9. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>t rv. ?G8211 rv (ret__unsigned_long_' t) \<equiv>\<^sup>? ?G8213 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (16 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S8221 rv rv cp (?cp8219 rv cp)) [SKIP] (withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s\<rbrakk> \<Longrightarrow> capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?S8221 rv rv cp (?cp8219 rv cp)) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 9. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 10. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv. ?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv \<equiv>\<^sup>? ?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
?G8213 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?G8211 rv (ret__unsigned_long_' t)
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (16 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s\<rbrakk> \<Longrightarrow> capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S8221 rv rv cp (?cp8219 rv cp)) [SKIP] (withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?S8221 rv rv cp (?cp8219 rv cp)) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 9. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 10. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv. ?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv \<equiv>\<^sup>? ?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
?G8213 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?G8211 rv (ret__unsigned_long_' t)
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (16 subgoals):
 1. \<And>rv cp sa. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap = capZombiePtr (cteCap rv); capZombieNumber (cteCap rv) = capZombieNumber cap; (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); valid_cap' cap sa; valid_cap' (cteCap rv) sa\<rbrakk> \<Longrightarrow> capZombieType cap = capZombieType (cteCap rv)
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S8221 rv rv cp (?cp8219 rv cp)) [SKIP] (withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?S8221 rv rv cp (?cp8219 rv cp)) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 9. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 10. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv. ?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv \<equiv>\<^sup>? ?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
?G8213 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?G8211 rv (ret__unsigned_long_' t)
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (16 subgoals):
 1. \<And>rv cp sa. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap = capZombiePtr (cteCap rv); capZombieNumber (cteCap rv) = capZombieNumber cap; (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); capAligned cap; capAligned (cteCap rv)\<rbrakk> \<Longrightarrow> capZombieType cap = capZombieType (cteCap rv)
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S8221 rv rv cp (?cp8219 rv cp)) [SKIP] (withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?S8221 rv rv cp (?cp8219 rv cp)) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 9. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 10. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv. ?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv \<equiv>\<^sup>? ?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
?G8213 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?G8211 rv (ret__unsigned_long_' t)
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (16 subgoals):
 1. \<And>rv cp sa. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap = capZombiePtr (cteCap rv); capZombieNumber (cteCap rv) = capZombieNumber cap; capAligned cap; capAligned (cteCap rv); capZombieType (cteCap rv) = capZombieType cap\<rbrakk> \<Longrightarrow> capZombieType cap = capZombieType (cteCap rv)
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S8221 rv rv cp (?cp8219 rv cp)) [SKIP] (withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?S8221 rv rv cp (?cp8219 rv cp)) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 9. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 10. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 16 subgoals...
flex-flex pairs:
\<lambda>rv. ?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv \<equiv>\<^sup>? ?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
?G8213 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?G8211 rv (ret__unsigned_long_' t)
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (15 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S8221 rv rv cp (?cp8219 rv cp)) [SKIP] (withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?S8221 rv rv cp (?cp8219 rv cp)) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 8. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 9. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv. ?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv \<equiv>\<^sup>? ?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
?G8213 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?G8211 rv (ret__unsigned_long_' t)
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (15 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S8221 rv rv cp (?cp8219 rv cp)) [SKIP] (withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?S8221 rv rv cp (?cp8219 rv cp)) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 8. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 9. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv. ?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv \<equiv>\<^sup>? ?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
?G8213 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?G8211 rv (ret__unsigned_long_' t)
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (15 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S8221 rv rv cp (?cp8219 rv cp)) [SKIP] (liftE (do endCTE <- getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap)
od)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?S8221 rv rv cp (?cp8219 rv cp)) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 8. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 9. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv. ?G8220 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv \<equiv>\<^sup>? ?G8211 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
?G8213 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?G8211 rv (ret__unsigned_long_' t)
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (15 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?C'8244 rv rv cp (?cp8219 rv cp)) [SKIP] (liftE (do endCTE <- getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
y <- assert (cteCap endCTE = capability.NullCap);
updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap)
od)) (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?C'8244 rv rv cp (?cp8219 rv cp) \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 8. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 9. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (15 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?C'8244 rv rv cp (?cp8219 rv cp)) [SKIP] (do x <- getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
x <- assert (cteCap x = capability.NullCap);
r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?C'8244 rv rv cp (?cp8219 rv cp) \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 8. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 9. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (16 subgoals):
 1. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8264 rv rv cp (?cp8219 rv cp) rva) (?Q'8263 rv rv cp (?cp8219 rv cp) rva) [SKIP] (do x <- assert (cteCap rva = capability.NullCap);
r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>?Q8264 rv rv cp (?cp8219 rv cp)\<rbrace>
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ?Q8264 rv rv cp (?cp8219 rv cp) rva s \<longrightarrow> s' \<in> ?Q'8263 rv rv cp (?cp8219 rv cp) rva} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 9. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 10. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 16 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (16 subgoals):
 1. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8264 rv rv cp (?cp8219 rv cp) rva) (?Q'8263 rv rv cp (?cp8219 rv cp) rva) [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>?Q8264 rv rv cp (?cp8219 rv cp)\<rbrace>
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ?Q8264 rv rv cp (?cp8219 rv cp) rva s \<longrightarrow> s' \<in> ?Q'8263 rv rv cp (?cp8219 rv cp) rva} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 9. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 10. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 16 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (19 subgoals):
 1. \<And>rv cp rva sa. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (cte_wp_at' ((=) rv) slot and invs') sa \<and> (sa, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1) ({s'. (sa, s') \<in> rf_sr} \<inter> \<lbrace>ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) \<acute>ret__struct_cap_C\<rbrace>)
 2. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 3. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 19 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (19 subgoals):
 1. \<And>rv cp rva sa. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. (cte_wp_at' ((=) rv) slot and invs') sa \<and> (sa, s') \<in> rf_sr} \<subseteq> {s. \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> isZombie capa \<and> capAligned capa \<and> unat (word_of_nat (capZombieNumber cap) - 1) \<le> zombieCTEs (capZombieType capa) \<and> (\<forall>t. ccap_relation (capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap) - 1)) capa) (ret__struct_cap_C_' t) \<longrightarrow> (sa, s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t\<rparr>) \<in> rf_sr \<and> ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) (ret__struct_cap_C_' t))}
 2. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 3. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 19 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (19 subgoals):
 1. \<And>rv cp rva sa x saa. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap rv); cte_wp_at' ((=) rv) slot sa; valid_cap' cap saa; valid_cap' (cteCap rv) saa; capZombieNumber (cteCap rv) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap rv); invs' sa; (sa, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> isZombie capa \<and> capAligned capa \<and> unat (word_of_nat (capZombieNumber cap) - 1) \<le> zombieCTEs (capZombieType capa) \<and> (\<forall>t. ccap_relation (capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap) - 1)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (capZombieNumber_update (\<lambda>x. x - Suc 0) cap) (ret__struct_cap_C_' t))
 2. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 3. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 19 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (19 subgoals):
 1. \<And>rv cp rva sa x saa capa ccap cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap rv); valid_cap' cap saa; valid_cap' (cteCap rv) saa; capZombieNumber (cteCap rv) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap rv); invs' sa; (sa, x) \<in> rf_sr; capa = cteCap cte; ccap = h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])); rv = cte; ccap_relation capa ccap; capAligned capa; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift ccap) = capZombiePtr capa; capZombieType_CL (cap_zombie_cap_lift ccap) = (case capZombieType capa of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> isZombie capa \<and> capAligned capa \<and> unat (word_of_nat (capZombieNumber cap) - 1) \<le> zombieCTEs (capZombieType capa) \<and> (\<forall>t. ccap_relation (capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap) - 1)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (capZombieNumber_update (\<lambda>x. x - Suc 0) cap) (ret__struct_cap_C_' t))
 2. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 3. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 19 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (19 subgoals):
 1. \<And>cp rva sa x saa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> \<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<and> isZombie capa \<and> capAligned capa \<and> unat (word_of_nat (capZombieNumber cap) - 1) \<le> zombieCTEs (capZombieType capa) \<and> (\<forall>t. ccap_relation (capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap) - 1)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (capZombieNumber_update (\<lambda>x. x - Suc 0) cap) (ret__struct_cap_C_' t))
 2. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 3. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 19 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (19 subgoals):
 1. \<And>cp rva sa x saa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> unat (word_of_nat (capZombieNumber cap) - 1) \<le> zombieCTEs (capZombieType (cteCap cte)) \<and> (\<forall>t. ccap_relation (capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap) - 1)) (cteCap cte)) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (capZombieNumber_update (\<lambda>x. x - Suc 0) cap) (ret__struct_cap_C_' t))
 2. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 3. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 19 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (20 subgoals):
 1. \<And>cp rva sa x saa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> word_of_nat (capZombieNumber cap) \<noteq> 0
 2. \<And>cp rva sa x saa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> unat (word_of_nat (capZombieNumber cap)) - 1 \<le> zombieCTEs (capZombieType (cteCap cte)) \<and> (\<forall>t. ccap_relation (capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap)) - 1) (cteCap cte)) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (capZombieNumber_update (\<lambda>x. x - Suc 0) cap) (ret__struct_cap_C_' t))
 3. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 5. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
A total of 20 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (20 subgoals):
 1. \<And>cp rva sa x saa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> capZombieNumber cap < 2 ^ LENGTH(32)
 2. \<And>cp rva sa x saa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> unat (word_of_nat (capZombieNumber cap)) - 1 \<le> zombieCTEs (capZombieType (cteCap cte)) \<and> (\<forall>t. ccap_relation (capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap)) - 1) (cteCap cte)) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (capZombieNumber_update (\<lambda>x. x - Suc 0) cap) (ret__struct_cap_C_' t))
 3. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 5. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
A total of 20 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (20 subgoals):
 1. \<And>cp rva sa x saa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); capZombieNumber cap \<in> unats 32\<rbrakk> \<Longrightarrow> capZombieNumber cap < 2 ^ LENGTH(32)
 2. \<And>cp rva sa x saa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> unat (word_of_nat (capZombieNumber cap)) - 1 \<le> zombieCTEs (capZombieType (cteCap cte)) \<and> (\<forall>t. ccap_relation (capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap)) - 1) (cteCap cte)) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (capZombieNumber_update (\<lambda>x. x - Suc 0) cap) (ret__struct_cap_C_' t))
 3. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 5. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
A total of 20 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; expo; (capZombiePtr (cteCap cte_) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte_) cp_; cteCap cte_ \<noteq> capability.NullCap; isZombie (cteCap cte_); cteCap rva_ = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte_); valid_cap' (cteCap cte_) saa_; capZombieNumber (cteCap cte_) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte_); invs' sa_; (sa_, x_) \<in> rf_sr; ccap_relation (cteCap cte_) (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte_); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte_); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte_) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); capZombieNumber cap \<in> unats 32\<rbrakk> \<Longrightarrow> capZombieNumber cap < 2 ^ LENGTH(32) proof (prove)
goal (19 subgoals):
 1. \<And>cp rva sa x saa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> unat (word_of_nat (capZombieNumber cap)) - 1 \<le> zombieCTEs (capZombieType (cteCap cte)) \<and> (\<forall>t. ccap_relation (capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap)) - 1) (cteCap cte)) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (capZombieNumber_update (\<lambda>x. x - Suc 0) cap) (ret__struct_cap_C_' t))
 2. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 3. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 19 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (20 subgoals):
 1. \<And>cp rva sa x saa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> unat (word_of_nat (capZombieNumber cap)) - 1 \<le> zombieCTEs (capZombieType (cteCap cte))
 2. \<And>cp rva sa x saa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> \<forall>t. ccap_relation (capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap)) - 1) (cteCap cte)) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (capZombieNumber_update (\<lambda>x. x - Suc 0) cap) (ret__struct_cap_C_' t)
 3. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 5. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
A total of 20 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (20 subgoals):
 1. \<And>cp rva sa x saa cte v1a v2. \<lbrakk>v2 < 2 ^ word_bits; 0 < v2; expo; (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) + 2 ^ cte_level_bits * (word_of_nat v2 - 1), s) \<in> fst (locateSlotCap (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) (word_of_nat v2 - 1) s); ccap_relation (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) cp; cteCap rva = capability.NullCap; invs' sa; (sa, x) \<in> rf_sr; ccap_relation (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case v1a of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); cap = capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2; cteCap cte = capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2; v2 \<le> zombieCTEs v1a; zBits v1a < word_bits; case v1a of ZombieTCB \<Rightarrow> tcb_at' (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) saa | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) + 2 ^ cteSizeBits * (addr && mask n)) saa)\<rbrakk> \<Longrightarrow> unat (word_of_nat v2) - Suc 0 \<le> zombieCTEs v1a
 2. \<And>cp rva sa x saa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> \<forall>t. ccap_relation (capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap)) - 1) (cteCap cte)) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (capZombieNumber_update (\<lambda>x. x - Suc 0) cap) (ret__struct_cap_C_' t)
 3. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 5. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
A total of 20 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (20 subgoals):
 1. \<And>cp rva sa x saa cte v1a v2. \<lbrakk>v2 < 2 ^ word_bits; 0 < v2; expo; (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) + 2 ^ cte_level_bits * (word_of_nat v2 - 1), s) \<in> fst (locateSlotCap (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) (word_of_nat v2 - 1) s); ccap_relation (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) cp; cteCap rva = capability.NullCap; invs' sa; (sa, x) \<in> rf_sr; ccap_relation (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case v1a of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); cap = capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2; cteCap cte = capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2; zBits v1a < word_bits; case v1a of ZombieTCB \<Rightarrow> tcb_at' (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) saa | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) + 2 ^ cteSizeBits * (addr && mask n)) saa)\<rbrakk> \<Longrightarrow> unat (word_of_nat v2) - Suc 0 \<le> v2
 2. \<And>cp rva sa x saa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> \<forall>t. ccap_relation (capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap)) - 1) (cteCap cte)) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (capZombieNumber_update (\<lambda>x. x - Suc 0) cap) (ret__struct_cap_C_' t)
 3. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 5. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
A total of 20 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (20 subgoals):
 1. \<And>cp rva sa x saa cte v1a v2. \<lbrakk>v2 < 2 ^ word_bits; 0 < v2; expo; (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) + 2 ^ cte_level_bits * (word_of_nat v2 - 1), s) \<in> fst (locateSlotCap (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) (word_of_nat v2 - 1) s); ccap_relation (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) cp; cteCap rva = capability.NullCap; invs' sa; (sa, x) \<in> rf_sr; ccap_relation (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case v1a of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); cap = capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2; cteCap cte = capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2; zBits v1a < word_bits; case v1a of ZombieTCB \<Rightarrow> tcb_at' (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) saa | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) + 2 ^ cteSizeBits * (addr && mask n)) saa)\<rbrakk> \<Longrightarrow> unat (word_of_nat v2) \<le> v2
 2. \<And>cp rva sa x saa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> \<forall>t. ccap_relation (capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap)) - 1) (cteCap cte)) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (capZombieNumber_update (\<lambda>x. x - Suc 0) cap) (ret__struct_cap_C_' t)
 3. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 5. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
A total of 20 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>v2_ < 2 ^ word_bits; 0 < v2_; expo; (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) + 2 ^ cte_level_bits * (word_of_nat v2_ - 1), s) \<in> fst (locateSlotCap (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a_ v2_) (word_of_nat v2_ - 1) s); ccap_relation (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a_ v2_) cp_; cteCap rva_ = capability.NullCap; invs' sa_; (sa_, x_) \<in> rf_sr; ccap_relation (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a_ v2_) (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a_ v2_); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case v1a_ of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); cap = capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a_ v2_; cteCap cte_ = capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a_ v2_; zBits v1a_ < word_bits; case v1a_ of ZombieTCB \<Rightarrow> tcb_at' (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) saa_ | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x_))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) + 2 ^ cteSizeBits * (addr && mask n)) saa_)\<rbrakk> \<Longrightarrow> unat (word_of_nat v2_) \<le> v2_ proof (prove)
goal (19 subgoals):
 1. \<And>cp rva sa x saa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> \<forall>t. ccap_relation (capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap)) - 1) (cteCap cte)) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (capZombieNumber_update (\<lambda>x. x - Suc 0) cap) (ret__struct_cap_C_' t)
 2. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 3. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 19 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (19 subgoals):
 1. \<And>cp rva sa x saa cte t. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); ccap_relation (capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap)) - Suc 0) (cteCap cte)) (ret__struct_cap_C_' t)\<rbrakk> \<Longrightarrow> ccap_relation (capZombieNumber_update (\<lambda>x. x - Suc 0) cap) (ret__struct_cap_C_' t)
 2. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 3. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 19 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (19 subgoals):
 1. \<And>cp rva sa x saa cte t. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap cte) cp; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); cteCap rva = capability.NullCap; capZombiePtr cap = capZombiePtr (cteCap cte); valid_cap' cap saa; valid_cap' (cteCap cte) saa; capZombieNumber (cteCap cte) = capZombieNumber cap; capZombieType cap = capZombieType (cteCap cte); invs' sa; (sa, x) \<in> rf_sr; ccap_relation (cteCap cte) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); capAligned (cteCap cte); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = capZombiePtr (cteCap cte); capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> capZombieNumber_update (\<lambda>_. unat (word_of_nat (capZombieNumber cap)) - Suc 0) (cteCap cte) = capZombieNumber_update (\<lambda>x. x - Suc 0) cap
 2. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 3. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 19 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (19 subgoals):
 1. \<And>cp rva sa x saa cte v1a v2. \<lbrakk>v2 < 2 ^ word_bits; 0 < v2; expo; (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) + 2 ^ cte_level_bits * (word_of_nat v2 - 1), s) \<in> fst (locateSlotCap (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) (word_of_nat v2 - 1) s); ccap_relation (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) cp; cteCap rva = capability.NullCap; valid_cap' (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) saa; invs' sa; (sa, x) \<in> rf_sr; ccap_relation (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case v1a of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); cap = capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2; cteCap cte = capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2; is_aligned (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (zBits v1a); zBits v1a < word_bits\<rbrakk> \<Longrightarrow> unat (word_of_nat v2) - Suc 0 = v2 - Suc 0
 2. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 3. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 19 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (19 subgoals):
 1. \<And>cp rva sa x cte v1a v2. \<lbrakk>v2 < 2 ^ word_bits; 0 < v2; expo; (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) + 2 ^ cte_level_bits * (word_of_nat v2 - 1), s) \<in> fst (locateSlotCap (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) (word_of_nat v2 - 1) s); ccap_relation (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) cp; cteCap rva = capability.NullCap; invs' sa; (sa, x) \<in> rf_sr; ccap_relation (capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2) (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))); cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap; capZombieType_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) = (case v1a of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); cap = capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2; cteCap cte = capability.Zombie (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) v1a v2; is_aligned (get_capZombiePtr_CL (cap_zombie_cap_lift (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))))) (zBits v1a); zBits v1a < word_bits; v2 \<in> unats 32\<rbrakk> \<Longrightarrow> unat (word_of_nat v2) - Suc 0 = v2 - Suc 0
 2. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 3. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 4. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 19 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (18 subgoals):
 1. \<And>rv cp rva rv' t t'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__struct_cap_C_' rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y'8269 rv cp rva rv')
 2. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (?y'8269 rv cp rva rv')
 3. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
A total of 18 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (17 subgoals):
 1. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P8272 rv rv cp (?cp8219 rv cp) rva) (?Q8269 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) rv')));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb. ?Q8269 rv cp rva)
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?P8272 rv rv cp (?cp8219 rv cp) rva and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 10. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (17 subgoals):
 1. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A8447 rv rv cp (?cp8219 rv cp) rva) (?C'8445 rv cp rva rv') [SKIP] (do r <- updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap);
return (Inr ())
od) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) rv'));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rvb rv'. ?C'8445 rv cp rva rv' \<inter> \<lbrace>True\<rbrace>)
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. ?A8447 rv rv cp (?cp8219 rv cp) rva and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (?A8447 rv rv cp (?cp8219 rv cp) rva and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 10. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (19 subgoals):
 1. \<And>rv cp rva rv' rvb xfdc. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8453 rv cp rva rv' rvb) (?Q'8453 rv cp rva rv' rvb xfdc) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R8456 rv rv cp (?cp8219 rv cp) rva\<rbrace> updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap) \<lbrace>?Q8453 rv cp rva rv'\<rbrace>
 3. \<And>rv cp rva rv' sa rvb. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'; dc rvb (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> ?Q'8453 rv cp rva rv' rvb (xfdc sa)
 4. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rv rv'. \<lbrace>ccap_relation (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap) rv'\<rbrace> \<inter> \<lbrace>cte_Ptr slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. (\<lambda>a. True) and ?R8456 rv rv cp (?cp8219 rv cp) rva and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. True) and ?R8456 rv rv cp (?cp8219 rv cp) rva and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 19 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (19 subgoals):
 1. \<And>rv cp rva rv' rvb xfdc. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R8456 rv rv cp (?cp8219 rv cp) rva\<rbrace> updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>rv cp rva rv' sa rvb. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'; dc rvb (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> UNIV
 4. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rv rv'. \<lbrace>ccap_relation (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap) rv'\<rbrace> \<inter> \<lbrace>cte_Ptr slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. (\<lambda>a. True) and ?R8456 rv rv cp (?cp8219 rv cp) rva and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. True) and ?R8456 rv rv cp (?cp8219 rv cp) rva and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 19 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (19 subgoals):
 1. \<And>rv cp rva rv' rvb xfdc \<sigma>. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'; dc rvb xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R8456 rv rv cp (?cp8219 rv cp) rva\<rbrace> updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>rv cp rva rv' sa rvb. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'; dc rvb (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> UNIV
 4. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rv rv'. \<lbrace>ccap_relation (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap) rv'\<rbrace> \<inter> \<lbrace>cte_Ptr slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>)
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. (\<lambda>a. True) and ?R8456 rv rv cp (?cp8219 rv cp) rva and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. True) and ?R8456 rv rv cp (?cp8219 rv cp) rva and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 19 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (18 subgoals):
 1. \<And>rv cp rva rv'. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R8456 rv rv cp (?cp8219 rv cp) rva\<rbrace> updateCap slot (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>rv cp rva rv' sa rvb. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'; dc rvb (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> UNIV
 3. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rv rv'. \<lbrace>ccap_relation (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap) rv'\<rbrace> \<inter> \<lbrace>cte_Ptr slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>)
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. (\<lambda>a. True) and ?R8456 rv rv cp (?cp8219 rv cp) rva and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. True) and ?R8456 rv rv cp (?cp8219 rv cp) rva and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 9. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
A total of 18 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (17 subgoals):
 1. \<And>rv cp rva rv' sa rvb. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap; ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap) rv'; dc rvb (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> UNIV
 2. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rv rv'. \<lbrace>ccap_relation (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap) rv'\<rbrace> \<inter> \<lbrace>cte_Ptr slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>)
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. (\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 8. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 9. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 10. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (16 subgoals):
 1. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv. ccap_relation (capZombieNumber_update (\<lambda>x. x - 1) cap)) ret__struct_cap_C_' (\<lambda>rv rv'. \<lbrace>ccap_relation (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap) rv'\<rbrace> \<inter> \<lbrace>cte_Ptr slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>)
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. (\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 9. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 10. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 16 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (16 subgoals):
 1. \<And>rv cp rva. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv); cteCap rva = capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>s. ccap_relation (capZombieNumber_update (\<lambda>x. x - Suc 0) cap) (ret__struct_cap_C_' s) \<longrightarrow> ccap_relation (capZombieNumber_update (\<lambda>_. capZombieNumber cap - Suc 0) cap) (ret__struct_cap_C_' s)
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. (\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 8. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 9. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 10. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 16 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (15 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s; capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv\<rbrace> getCTE (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) \<lbrace>\<lambda>rva. (\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')\<rbrace>
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 8. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 9. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
?A8251 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?A8250 rv (ret__unsigned_long_' t)
?A8250 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<equiv>\<^sup>? \<lambda>rv. ?A8248 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (14 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8199 rv cp) [SKIP] (if capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8199 rv cp)}})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 7. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 8. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 14 subgoals...
flex-flex pairs:
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (15 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> \<not> (capZombiePtr cap = capZombiePtr (cteCap rv) \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8530 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8531 rv rv cp (?cp8529 rv cp)) [SKIP] (haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8531 rv rv cp (?cp8529 rv cp))}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 8. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 9. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv. ?R8530 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv \<equiv>\<^sup>? ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (14 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8530 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8531 rv rv cp (?cp8529 rv cp)) [SKIP] (haskell_assertE (capZombiePtr (cteCap rv) = slot \<and> capZombiePtr cap \<noteq> slot) []) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8531 rv rv cp (?cp8529 rv cp))}})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 7. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 8. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>rv. ?R8530 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv \<equiv>\<^sup>? ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (14 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap rv) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); capZombiePtr cap = capZombiePtr (cteCap rv); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap); (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8530 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8531 rv rv cp (?cp8529 rv cp)) [SKIP] fail (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> ?T8531 rv rv cp (?cp8529 rv cp))}})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 7. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 8. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>rv. ?R8530 rv () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv \<equiv>\<^sup>? ?R8200 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
?R8202 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R8200 rv (ret__unsigned_long_' t)
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (13 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)); word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if (case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0\<rparr> \<in> {s. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) rv) slot and invs')) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> s \<in> UNIV)}})
 2. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv); cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = word_of_nat (capZombieNumber (cteCap rv))) ret__unsigned_long_' (\<lambda>rva rv'. {s. s\<lparr>ret__int_' := if word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) then 1 else 0\<rparr> \<in> {s. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> s \<in> UNIV)}})
 3. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. rv' = capZombiePtr (cteCap rv)) ret__unsigned_long_' (\<lambda>rva rv'. {s. ptr2_'_update (\<lambda>_. cte_Ptr (capZombiePtr (cteCap rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) then 1 else 0\<rparr> \<in> {s. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] (if cteCap rv = capability.NullCap then returnOk () else if isZombie (cteCap rv) then let ptr2 = capZombiePtr (cteCap rv) in if capZombiePtr cap = ptr2 \<and> capZombieNumber (cteCap rv) = capZombieNumber cap \<and> capZombieType cap = capZombieType (cteCap rv) then withoutPreemption $ do endCTE <- getCTE (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1));
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber cap - 1) cap) >>= updateCap slot
od else haskell_assertE (ptr2 = slot \<and> capZombiePtr cap \<noteq> slot) [] else haskell_fail []) (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 6. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 7. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 10. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rva)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rva) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rva) s)) a) \<and> ((case capZombieType (cteCap rva) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rva)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rva) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> True)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
A total of 13 subgoals...
flex-flex pairs:
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (10 subgoals):
 1. \<And>rv cp. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); ccap_relation (cteCap rv) cp; cteCap rv \<noteq> capability.NullCap; \<not> isZombie (cteCap rv)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T6708 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (cap_get_tag cp)) [SKIP] fail (Guard DontReach {} SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> ?T6708 immediate slota status rv a)})})
 3. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> ?R6704 () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) a aa))) and cte_wp_at' ((=) a) slot\<rbrace>
 4. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rva = capability.NullCap \<longrightarrow> True) \<and> (cteCap rva \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rva) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rva)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rva) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rva) s)) a) \<and> ((case capZombieType (cteCap rva) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rva)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rva) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rva)) \<longrightarrow> True)) and (cte_wp_at' ((=) rva) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rva) \<longrightarrow> ?R6706 immediate slota t rv rva a))) and cte_wp_at' ((=) rva) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 9. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 10. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
?R6706 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) \<equiv>\<^sup>? \<lambda>t rv. ?R6704 rv (ret__unsigned_long_' t)
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (9 subgoals):
 1. \<And>immediate slota status rv. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rva rv'. \<exists>cp. ccap_relation (cteCap rv) cp \<and> rv' = cap_get_tag cp) ret__unsigned_' (\<lambda>rva a. {s. (cteCap rv = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> s \<in> UNIV)})})
 2. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> True))) and cte_wp_at' ((=) a) slot\<rbrace>
 3. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 8. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 9. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (8 subgoals):
 1. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a. (\<lambda>aa. (cteCap a = capability.NullCap \<longrightarrow> True) \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap a) \<longrightarrow> ((\<lambda>aa. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> ((\<lambda>aa. (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>aa. ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot)) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) aa) \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap a) s \<and> valid_cap' cap s)) aa)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap a)) \<longrightarrow> True)) and (cte_wp_at' ((=) a) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))) aa) \<and> (\<not> isZombie (cteCap a) \<longrightarrow> True))) and cte_wp_at' ((=) a) slot\<rbrace>
 2. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (8 subgoals):
 1. \<And>immediate slota status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?A6264 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) ()\<rbrace> getCTE slot \<lbrace>\<lambda>a aa. cte_wp_at' ((=) a) slot aa \<and> (cteCap a \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap a) \<longrightarrow> invs' aa \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> cte_wp_at' ((=) a) slot aa \<and> (capZombiePtr cap = capZombiePtr (cteCap a) \<longrightarrow> invs' aa \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> cte_wp_at' ((=) a) slot aa \<and> (word_of_nat (capZombieNumber (cteCap a)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)) \<and> (word_of_nat (capZombieNumber (cteCap a)) = word_of_nat (capZombieNumber cap) \<longrightarrow> invs' aa \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> cte_wp_at' ((=) a) slot aa \<and> ((case capZombieType (cteCap a) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> invs' aa \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> cte_wp_at' ((=) a) slot aa \<and> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap a) s)))))\<rbrace>
 2. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. ?A6264 immediate slota a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (7 subgoals):
 1. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 immediate slota err) (?Q''5715 err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. (\<lambda>a. cte_wp_at' (\<lambda>_. True) slot a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (capZombiePtr cap = capZombiePtr (cteCap cte) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (word_of_nat (capZombieNumber (cteCap cte)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s)) \<and> (word_of_nat (capZombieNumber (cteCap cte)) = word_of_nat (capZombieNumber cap) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> ((case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s))))))) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (7 subgoals):
 1. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv' status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) err) (?Q''5715 err rv' status) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv');;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. (\<lambda>a. cte_wp_at' (\<lambda>_. True) slot a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (capZombiePtr cap = capZombiePtr (cteCap cte) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (word_of_nat (capZombieNumber (cteCap cte)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s)) \<and> (word_of_nat (capZombieNumber (cteCap cte)) = word_of_nat (capZombieNumber cap) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> ((case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s))))))) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?Q''5714 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>t err. ?Q''5715 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?Q''5714 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (8 subgoals):
 1. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv' status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE5696 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) err) (?P'8555 err rv' status) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv' status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8554 err rv' status) return_C ret__unsigned_long_'_update (\<lambda>a. rv') {},UNIV
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. (\<lambda>a. cte_wp_at' (\<lambda>_. True) slot a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (capZombiePtr cap = capZombiePtr (cteCap cte) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (word_of_nat (capZombieNumber (cteCap cte)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s)) \<and> (word_of_nat (capZombieNumber (cteCap cte)) = word_of_nat (capZombieNumber cap) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> ((case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s))))))) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>?QE5696 immediate slota\<rbrace>
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> ?P'8552 immediate slota t err \<inter> ?R'8551 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>t err. ?P'8555 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?P'8552 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)
\<lambda>t err. ?R'8554 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?R'8551 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (8 subgoals):
 1. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv' status\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>a. rv') {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv' status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8554 err rv' status) return_C ret__unsigned_long_'_update (\<lambda>a. rv') {},UNIV
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. (\<lambda>a. cte_wp_at' (\<lambda>_. True) slot a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (capZombiePtr cap = capZombiePtr (cteCap cte) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (word_of_nat (capZombieNumber (cteCap cte)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s)) \<and> (word_of_nat (capZombieNumber (cteCap cte)) = word_of_nat (capZombieNumber cap) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> ((case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s))))))) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'8551 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>t err. ?R'8554 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?R'8551 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (8 subgoals):
 1. \<And>immediate slota err rv' status \<sigma>. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv' status\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := rv', global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := rv', global_exn_var_' := Return\<rparr>))}
 2. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv' status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8554 err rv' status) return_C ret__unsigned_long_'_update (\<lambda>a. rv') {},UNIV
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. (\<lambda>a. cte_wp_at' (\<lambda>_. True) slot a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (capZombiePtr cap = capZombiePtr (cteCap cte) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (word_of_nat (capZombieNumber (cteCap cte)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s)) \<and> (word_of_nat (capZombieNumber (cteCap cte)) = word_of_nat (capZombieNumber cap) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> ((case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s))))))) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'8551 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 7. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 8. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>t err. ?R'8554 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?R'8551 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (7 subgoals):
 1. \<And>immediate slota err rv' status. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv' status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8554 err rv' status) return_C ret__unsigned_long_'_update (\<lambda>a. rv') {},UNIV
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. (\<lambda>a. cte_wp_at' (\<lambda>_. True) slot a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (capZombiePtr cap = capZombiePtr (cteCap cte) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (word_of_nat (capZombieNumber (cteCap cte)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s)) \<and> (word_of_nat (capZombieNumber (cteCap cte)) = word_of_nat (capZombieNumber cap) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> ((case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s))))))) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'8551 immediate slota t err))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>t err. ?R'8554 err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? ?R'8551 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot) proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?R5709 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cutMon ((=) s) (cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False) \<lbrace>\<lambda>a. (\<lambda>a. cte_wp_at' (\<lambda>_. True) slot a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (capZombiePtr cap = capZombiePtr (cteCap cte) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (word_of_nat (capZombieNumber (cteCap cte)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s)) \<and> (word_of_nat (capZombieNumber (cteCap cte)) = word_of_nat (capZombieNumber cap) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> ((case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> cte_wp_at' ((=) cte) slot a \<and> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s))))))) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and ?R5709 immediate slota and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?P'8578 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False \<lbrace>\<lambda>rv s. (cte_wp_at' (\<lambda>_. True) slot s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) slot s \<and> cte_wp_at' ((=) cte) slot s \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> invs' s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> cte_wp_at' ((=) cte) slot s \<and> (capZombiePtr cap = capZombiePtr (cteCap cte) \<longrightarrow> invs' s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> cte_wp_at' ((=) cte) slot s \<and> (word_of_nat (capZombieNumber (cteCap cte)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s)) \<and> (word_of_nat (capZombieNumber (cteCap cte)) = word_of_nat (capZombieNumber cap) \<longrightarrow> invs' s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> cte_wp_at' ((=) cte) slot s \<and> ((case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> invs' s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> cte_wp_at' ((=) cte) slot s \<and> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s))))))) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val slota) s\<rbrace>, -
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and (\<lambda>a. True \<and> ?P'8578 immediate slota a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s)\<rbrakk> \<Longrightarrow> \<lbrace>?P'8578 (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr slot)\<rbrace> cteDelete (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) False \<lbrace>\<lambda>rv. invs' and cte_wp_at' (\<lambda>_. True) slot and valid_cap' cap\<rbrace>, -
 2. \<And>immediate slota rv sa. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); (invs' and cte_wp_at' (\<lambda>_. True) slot and valid_cap' cap) sa\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>_. True) slot sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) slot sa \<and> cte_wp_at' ((=) cte) slot sa \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>_. True) slot sa \<and> cte_wp_at' ((=) cte) slot sa \<and> (capZombiePtr cap = capZombiePtr (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>_. True) slot sa \<and> cte_wp_at' ((=) cte) slot sa \<and> (word_of_nat (capZombieNumber (cteCap cte)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s)) \<and> (word_of_nat (capZombieNumber (cteCap cte)) = word_of_nat (capZombieNumber cap) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>_. True) slot sa \<and> cte_wp_at' ((=) cte) slot sa \<and> ((case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>_. True) slot sa \<and> cte_wp_at' ((=) cte) slot sa \<and> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s))))))) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val slota) sa
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 6. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 7. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and (\<lambda>a. True \<and> ?P'8578 immediate slota a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>immediate slota rv sa. \<lbrakk>isZombie cap; immediate = SCAST(32 signed \<rightarrow> 32) true; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); (invs' and cte_wp_at' (\<lambda>_. True) slot and valid_cap' cap) sa\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>_. True) slot sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) slot sa \<and> cte_wp_at' ((=) cte) slot sa \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>_. True) slot sa \<and> cte_wp_at' ((=) cte) slot sa \<and> (capZombiePtr cap = capZombiePtr (cteCap cte) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>_. True) slot sa \<and> cte_wp_at' ((=) cte) slot sa \<and> (word_of_nat (capZombieNumber (cteCap cte)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s)) \<and> (word_of_nat (capZombieNumber (cteCap cte)) = word_of_nat (capZombieNumber cap) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>_. True) slot sa \<and> cte_wp_at' ((=) cte) slot sa \<and> ((case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> invs' sa \<and> cte_wp_at' (\<lambda>_. True) slot sa \<and> cte_wp_at' ((=) cte) slot sa \<and> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s))))))) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val slota) sa
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and (\<lambda>s. False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) s)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> valid_cap' cap a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>sa cte. \<lbrakk>isZombie cap; capZombieNumber cap < 2 ^ word_bits; 0 < capZombieNumber cap; expo; (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1), s) \<in> fst (locateSlotCap cap (word_of_nat (capZombieNumber cap) - 1) s); invs' sa; valid_cap' cap sa; ctes_of sa slot = Some cte; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); capZombiePtr cap = capZombiePtr (cteCap cte)\<rbrakk> \<Longrightarrow> (word_of_nat (capZombieNumber (cteCap cte)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s)) \<and> (word_of_nat (capZombieNumber (cteCap cte)) = word_of_nat (capZombieNumber cap) \<longrightarrow> (case capZombieType (cteCap cte) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> (\<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap cte) s))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 5. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 6. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and (\<lambda>s. False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) s)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> valid_cap' cap a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5178 (from_bool expo) (cte_Ptr slot)) (?T5180 (from_bool expo) (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> ?T5180 immediate slota)})})}})
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and (\<lambda>s. False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) s)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> valid_cap' cap a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> ?R5178 immediate slota a)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits; capZombieNumber cap \<noteq> 0; \<not> (True \<and> \<not> expo); \<not> (True \<and> expo)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>_. True) UNIV [SKIP] (cutMon ((=) s) (haskell_fail [])) (IF expo THEN
  Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>endSlot :== cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))));;
\<acute>status :== CALL cteDelete_'proc(\<acute>endSlot,SCAST(32 signed \<rightarrow> 32) false);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombiePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ptr2 :== cte_Ptr \<acute>ret__unsigned_long;;
\<acute>ret__int :== (if cte_Ptr (capZombiePtr cap) = \<acute>ptr2 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned_long :== CALL cap_zombie_cap_get_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = word_of_nat (capZombieNumber cap) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_zombie_cap_get_capZombieType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__struct_cap_C :== CALL cap_zombie_cap_set_capZombieNumber_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])),word_of_nat (capZombieNumber cap) - 1));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)))
FI
ELSE
  Guard DontReach {} SKIP
FI
FI
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (capZombiePtr cap)} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capZombiePtr cap)\<rightarrow>[''cap_C'']))));;
CALL capSwapForDelete_'proc(cte_Ptr (capZombiePtr cap),cte_Ptr slot)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> UNIV)})})}})
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 4. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 5. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and (\<lambda>s. False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) s)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> valid_cap' cap a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> True)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x)) ret__unsigned_' (\<lambda>rv rv'. {s. type_'_update (\<lambda>_. case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) s \<in> {s. (capZombieNumber cap = 0 \<longrightarrow> s \<in> UNIV) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> s \<in> {s. (True \<and> \<not> expo \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) s \<longrightarrow> s' \<in> \<lbrace>True\<rbrace> \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> s \<in> {s. (True \<and> expo \<longrightarrow> s \<in> {s. array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - 1) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<in> {s. endSlot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (slot_'_update (\<lambda>_. cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool False\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. (cteCap rv = capability.NullCap \<longrightarrow> True) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> (isZombie (cteCap rv) \<longrightarrow> ((\<lambda>a. (cte_Ptr (capZombiePtr cap) = cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> ((\<lambda>a. (word_of_nat (capZombieNumber (cteCap rv)) = word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. \<exists>s. valid_cap' cap s \<and> valid_cap' (cteCap rv) s)) a) \<and> ((case capZombieType (cteCap rv) of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<noteq> (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (word_of_nat (capZombieNumber (cteCap rv)) \<noteq> word_of_nat (capZombieNumber cap) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>_. \<exists>s. valid_cap' (cteCap rv) s \<and> valid_cap' cap s)) a)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (cte_Ptr (capZombiePtr cap) \<noteq> cte_Ptr (capZombiePtr (cteCap rv)) \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) a) \<and> (\<not> isZombie (cteCap rv) \<longrightarrow> True))) and cte_wp_at' ((=) rv) slot) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> \<lbrace>True\<rbrace>))}} \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace>}) \<and> (\<not> (True \<and> expo) \<longrightarrow> s \<in> UNIV)})})}})
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 4. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and (\<lambda>s. False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) s)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> valid_cap' cap a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> True)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<forall>s. ret__unsigned_' s = (case capZombieType cap of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x) \<longrightarrow> 0 < capZombieNumber cap \<longrightarrow> expo \<longrightarrow> array_assertion (cte_Ptr (capZombiePtr cap)) (capZombieNumber cap - Suc 0) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1) \<and> (word_of_nat (capZombieNumber cap) = 1 \<or> array_assertion (cte_Ptr (capZombiePtr cap)) (unat (word_of_nat (capZombieNumber cap) - 1)) (hrs_htd (t_hrs_' (globals s))))
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 4. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and (\<lambda>s. False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) s)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> valid_cap' cap a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> True)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>v0 v1 v2 s. \<lbrakk>v2 < 2 ^ word_bits; cap = capability.Zombie v0 v1 v2; ret__unsigned_' s = (case v1 of ZombieTCB \<Rightarrow> ZombieTCB_C | ZombieCNode x \<Rightarrow> word_of_nat x); 0 < v2; expo; array_assertion (cte_Ptr v0) (v2 - Suc 0) (hrs_htd (t_hrs_' (globals s))); \<not> array_assertion (cte_Ptr v0) (unat (word_of_nat v2 - 1)) (hrs_htd (t_hrs_' (globals s)))\<rbrakk> \<Longrightarrow> word_of_nat v2 = 1
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 3. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 4. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and (\<lambda>s. False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) s)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> valid_cap' cap a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> True)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (capZombieNumber cap)) n_' (\<lambda>rv rv'. UNIV \<inter> \<lbrace>True\<rbrace>)
 2. \<And>immediate slota. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; capZombieNumber cap < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = capZombiePtr cap) ret__unsigned_long_' (\<lambda>rv rv'. {s. s\<lparr>ptr___ptr_to_struct_cte_C_' := cte_Ptr (capZombiePtr cap)\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>})
 3. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capZombieNumber cap = 0 \<longrightarrow> True) \<and> (capZombieNumber cap \<noteq> 0 \<longrightarrow> (True \<and> \<not> expo \<longrightarrow> (valid_mdb' and pspace_aligned' and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap)))) a) \<and> (\<not> (True \<and> \<not> expo) \<longrightarrow> (True \<and> expo \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and (\<lambda>s. False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) s)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> valid_cap' cap a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))))) and valid_cap' cap and (\<lambda>_. isZombie cap \<and> word_of_nat (capZombieNumber cap) - 1 = word_of_nat (capZombieNumber cap - 1))) a) \<and> (\<not> (True \<and> expo) \<longrightarrow> True)))) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot and invs') and cte_wp_at' (\<lambda>_. True) (ptr_val slota) and (\<lambda>_. capZombieNumber cap < 2 ^ word_bits)) s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>immediate slota s s'. \<lbrakk>isZombie cap; immediate = from_bool expo; slota = cte_Ptr slot; (s, s') \<in> rf_sr; invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cap) slot s\<rbrakk> \<Longrightarrow> (0 < capZombieNumber cap \<longrightarrow> (\<not> expo \<longrightarrow> valid_mdb' s \<and> pspace_aligned' s \<and> cte_wp_at' (\<lambda>_. True) (capZombiePtr cap) s) \<and> (expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr cap + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber cap) - 1)) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>_. True) (capZombiePtr cap + (word_of_nat (capZombieNumber cap) - 1) * word_of_nat (size_of TYPE(cte_C))) s \<and> valid_cap' cap s)) \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> capZombieNumber cap < 2 ^ word_bits proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte. \<lbrakk>isZombie (cteCap cte); (s, s') \<in> rf_sr; invs' s; sch_act_simple s; ctes_of s slot = Some cte; cap = cteCap cte\<rbrakk> \<Longrightarrow> (0 < capZombieNumber (cteCap cte) \<longrightarrow> (\<not> expo \<longrightarrow> valid_mdb' s \<and> pspace_aligned' s \<and> (\<exists>ctea. ctes_of s (capZombiePtr (cteCap cte)) = Some ctea)) \<and> (expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (capZombiePtr (cteCap cte) + 2 ^ cte_level_bits * (word_of_nat (capZombieNumber (cteCap cte)) - 1)) s \<and> valid_cap' (cteCap cte) s \<and> (\<exists>ctea. ctes_of s (capZombiePtr (cteCap cte) + (word_of_nat (capZombieNumber (cteCap cte)) - 1) * word_of_nat (size_of TYPE(cte_C))) = Some ctea) \<and> valid_cap' (cteCap cte) s)) \<and> capZombieNumber (cteCap cte) < 2 ^ word_bits proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte v0 v1 v2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ctes_of s slot = Some cte; cap = capability.Zombie v0 v1 v2; cteCap cte = capability.Zombie v0 v1 v2\<rbrakk> \<Longrightarrow> (0 < v2 \<longrightarrow> (\<not> expo \<longrightarrow> valid_mdb' s \<and> pspace_aligned' s \<and> (\<exists>cte. ctes_of s v0 = Some cte)) \<and> (expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + 2 ^ cte_level_bits * (word_of_nat v2 - 1)) s \<and> valid_cap' (capability.Zombie v0 v1 v2) s \<and> (\<exists>cte. ctes_of s (v0 + (word_of_nat v2 - 1) * word_of_nat (size_of TYPE(cte_C))) = Some cte) \<and> valid_cap' (capability.Zombie v0 v1 v2) s)) \<and> v2 < 2 ^ word_bits proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte v0 v1 v2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ctes_of s slot = Some cte; cap = capability.Zombie v0 v1 v2; cteCap cte = capability.Zombie v0 v1 v2; valid_cap' (capability.Zombie v0 v1 v2) s\<rbrakk> \<Longrightarrow> (0 < v2 \<longrightarrow> (\<not> expo \<longrightarrow> valid_mdb' s \<and> pspace_aligned' s \<and> (\<exists>cte. ctes_of s v0 = Some cte)) \<and> (expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + 2 ^ cte_level_bits * (word_of_nat v2 - 1)) s \<and> (\<exists>cte. ctes_of s (v0 + (word_of_nat v2 - 1) * word_of_nat (size_of TYPE(cte_C))) = Some cte))) \<and> v2 < 2 ^ word_bits proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte v0 v1 v2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ctes_of s slot = Some cte; cap = capability.Zombie v0 v1 v2; cteCap cte = capability.Zombie v0 v1 v2; valid_cap' (capability.Zombie v0 v1 v2) s; v2 < 2 ^ word_bits; 0 < v2\<rbrakk> \<Longrightarrow> (\<not> expo \<longrightarrow> valid_mdb' s \<and> pspace_aligned' s \<and> (\<exists>cte. ctes_of s v0 = Some cte)) \<and> (expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + 2 ^ cte_level_bits * (word_of_nat v2 - 1)) s \<and> (\<exists>cte. ctes_of s (v0 + (word_of_nat v2 - 1) * word_of_nat (size_of TYPE(cte_C))) = Some cte)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte v0 v1 v2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ctes_of s slot = Some cte; cap = capability.Zombie v0 v1 v2; cteCap cte = capability.Zombie v0 v1 v2; valid_cap' (capability.Zombie v0 v1 v2) s; v2 < 2 ^ word_bits; 0 < v2; ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + (2 ^ cteSizeBits * word_of_nat v2 - 2 ^ cteSizeBits)) s\<rbrakk> \<Longrightarrow> (\<not> expo \<longrightarrow> valid_mdb' s \<and> pspace_aligned' s \<and> (\<exists>cte. ctes_of s v0 = Some cte)) \<and> (expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + 2 ^ cte_level_bits * (word_of_nat v2 - 1)) s \<and> (\<exists>cte. ctes_of s (v0 + (word_of_nat v2 - 1) * word_of_nat (size_of TYPE(cte_C))) = Some cte)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte v0 v1 v2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ctes_of s slot = Some cte; cap = capability.Zombie v0 v1 v2; cteCap cte = capability.Zombie v0 v1 v2; valid_cap' (capability.Zombie v0 v1 v2) s; v2 < 2 ^ word_bits; 0 < v2; ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + (2 ^ cteSizeBits * word_of_nat v2 - 2 ^ cteSizeBits)) s\<rbrakk> \<Longrightarrow> (\<not> expo \<longrightarrow> valid_mdb' s \<and> pspace_aligned' s \<and> (\<exists>cte. ctes_of s v0 = Some cte)) \<and> (expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + (0x10 * word_of_nat v2 - 0x10)) s \<and> (\<exists>cte. ctes_of s (v0 + (word_of_nat v2 - 1) * word_of_nat (size_of TYPE(cte_C))) = Some cte)) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte v0 v1 v2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ctes_of s slot = Some cte; cap = capability.Zombie v0 v1 v2; cteCap cte = capability.Zombie v0 v1 v2; valid_cap' (capability.Zombie v0 v1 v2) s; v2 < 2 ^ word_bits; 0 < v2; ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + (2 ^ cteSizeBits * word_of_nat v2 - 2 ^ cteSizeBits)) s\<rbrakk> \<Longrightarrow> v2 - 1 < zombieCTEs v1
 2. \<And>s s' cte v0 v1 v2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ctes_of s slot = Some cte; cap = capability.Zombie v0 v1 v2; cteCap cte = capability.Zombie v0 v1 v2; valid_cap' (capability.Zombie v0 v1 v2) s; v2 < 2 ^ word_bits; 0 < v2; ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + (2 ^ cteSizeBits * word_of_nat v2 - 2 ^ cteSizeBits)) s; cte_wp_at' (\<lambda>_. True) (v0 + word_of_nat (v2 - 1) * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (\<not> expo \<longrightarrow> valid_mdb' s \<and> pspace_aligned' s \<and> (\<exists>cte. ctes_of s v0 = Some cte)) \<and> (expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + (0x10 * word_of_nat v2 - 0x10)) s \<and> (\<exists>cte. ctes_of s (v0 + (word_of_nat v2 - 1) * word_of_nat (size_of TYPE(cte_C))) = Some cte)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte v0 v1 v2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ctes_of s slot = Some cte; cap = capability.Zombie v0 v1 v2; cteCap cte = capability.Zombie v0 v1 v2; valid_cap' (capability.Zombie v0 v1 v2) s; v2 < 2 ^ word_bits; 0 < v2; ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + (2 ^ cteSizeBits * word_of_nat v2 - 2 ^ cteSizeBits)) s; cte_wp_at' (\<lambda>_. True) (v0 + word_of_nat (v2 - 1) * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (\<not> expo \<longrightarrow> valid_mdb' s \<and> pspace_aligned' s \<and> (\<exists>cte. ctes_of s v0 = Some cte)) \<and> (expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + (0x10 * word_of_nat v2 - 0x10)) s \<and> (\<exists>cte. ctes_of s (v0 + (word_of_nat v2 - 1) * word_of_nat (size_of TYPE(cte_C))) = Some cte)) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte v0 v1 v2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ctes_of s slot = Some cte; cap = capability.Zombie v0 v1 v2; cteCap cte = capability.Zombie v0 v1 v2; valid_cap' (capability.Zombie v0 v1 v2) s; v2 < 2 ^ word_bits; 0 < v2; ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + (2 ^ cteSizeBits * word_of_nat v2 - 2 ^ cteSizeBits)) s; cte_wp_at' (\<lambda>_. True) (v0 + word_of_nat (v2 - 1) * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> 0 < zombieCTEs v1
 2. \<And>s s' cte v0 v1 v2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ctes_of s slot = Some cte; cap = capability.Zombie v0 v1 v2; cteCap cte = capability.Zombie v0 v1 v2; valid_cap' (capability.Zombie v0 v1 v2) s; v2 < 2 ^ word_bits; 0 < v2; ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + (2 ^ cteSizeBits * word_of_nat v2 - 2 ^ cteSizeBits)) s; cte_wp_at' (\<lambda>_. True) (v0 + word_of_nat (v2 - 1) * 2 ^ cteSizeBits) s; cte_wp_at' (\<lambda>_. True) (v0 + word_of_nat 0 * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (\<not> expo \<longrightarrow> valid_mdb' s \<and> pspace_aligned' s \<and> (\<exists>cte. ctes_of s v0 = Some cte)) \<and> (expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + (0x10 * word_of_nat v2 - 0x10)) s \<and> (\<exists>cte. ctes_of s (v0 + (word_of_nat v2 - 1) * word_of_nat (size_of TYPE(cte_C))) = Some cte)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte v0 v1 v2. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ctes_of s slot = Some cte; cap = capability.Zombie v0 v1 v2; cteCap cte = capability.Zombie v0 v1 v2; valid_cap' (capability.Zombie v0 v1 v2) s; v2 < 2 ^ word_bits; 0 < v2; ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + (2 ^ cteSizeBits * word_of_nat v2 - 2 ^ cteSizeBits)) s; cte_wp_at' (\<lambda>_. True) (v0 + word_of_nat (v2 - 1) * 2 ^ cteSizeBits) s; cte_wp_at' (\<lambda>_. True) (v0 + word_of_nat 0 * 2 ^ cteSizeBits) s\<rbrakk> \<Longrightarrow> (\<not> expo \<longrightarrow> valid_mdb' s \<and> pspace_aligned' s \<and> (\<exists>cte. ctes_of s v0 = Some cte)) \<and> (expo \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + (0x10 * word_of_nat v2 - 0x10)) s \<and> (\<exists>cte. ctes_of s (v0 + (word_of_nat v2 - 1) * word_of_nat (size_of TYPE(cte_C))) = Some cte)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte v0 v1 v2 ctea cteb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ctes_of s slot = Some cte; cap = capability.Zombie v0 v1 v2; cteCap cte = capability.Zombie v0 v1 v2; valid_cap' (capability.Zombie v0 v1 v2) s; v2 < 2 ^ word_bits; 0 < v2; ex_cte_cap_wp_to' (\<lambda>_. True) (v0 + (0x10 * word_of_nat v2 - 0x10)) s; ctes_of s (v0 + (word_of_nat v2 * 0x10 - 0x10)) = Some ctea; ctes_of s v0 = Some cteb; \<not> expo\<rbrakk> \<Longrightarrow> valid_mdb' s \<and> pspace_aligned' s proof (prove)
goal:
No subgoals!