theory CNodeInv_R

lemma finaliseSlot_invs':
  assumes finaliseCap:
    "\<And>cap final sl. \<lbrace>no_cte_prop Pr and invs' and sch_act_simple
        and cte_wp_at' (\<lambda>cte. cteCap cte = cap) sl\<rbrace> finaliseCap cap final False \<lbrace>\<lambda>rv. no_cte_prop Pr\<rbrace>"
  and stuff: "finalise_prop_stuff Pr"
  shows
  "st \<turnstile> \<lbrace>\<lambda>s.
      no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s
              \<and> (exposed \<or> ex_cte_cap_to' slot s)
              \<and> (exposed \<or> p = slot \<or>
                  cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte)
                                  \<or> (\<exists>zb n cp. cteCap cte = Zombie p zb n
                                       \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace>
       finaliseSlot' slot exposed
   \<lbrace>\<lambda>rv s.
      no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s
              \<and> (exposed \<or> p = slot \<or>
                  cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte)
                                  \<or> (\<exists>zb n cp. cteCap cte = Zombie p zb n
                                       \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)
              \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' slot s (cteCap cte)) slot s)
              \<and> (\<forall>sl'. snd rv \<noteq> NullCap \<longrightarrow> sl' \<noteq> slot \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>,
   \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>" proof (induct arbitrary: P p rule: finalise_spec_induct2) case (1 sl exp s Q q) let ?P = "\<lambda>cte. (Q and isZombie) (cteCap cte)
                     \<or> (\<exists>zb n cp. cteCap cte = Zombie q zb n
                          \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))" note hyps = "1.hyps"[folded reduceZombie_def[unfolded cteDelete_def finaliseSlot_def]] have Q: "\<And>x y n. {x :: word32} = (\<lambda>x. y + x * 2^cteSizeBits) ` {0 ..< n} \<Longrightarrow> n = 1" apply (drule sym) apply (case_tac "1 < n") apply (frule_tac x = "y + 0 * 2^cteSizeBits" in eqset_imp_iff) apply (frule_tac x = "y + 1 * 2^cteSizeBits" in eqset_imp_iff) apply (subst(asm) imageI, simp) apply (erule order_less_trans[rotated], simp) apply (subst(asm) imageI, simp) apply simp apply (simp add: linorder_not_less objBits_defs) apply (case_tac "n < 1") apply simp apply simp done have R: "\<And>n. n \<noteq> 0 \<Longrightarrow> {0 .. n - 1} = {0 ..< n :: word32}" apply safe apply simp apply (erule(1) word_leq_minus_one_le) apply simp apply (erule word_le_minus_one_leq) done have final_IRQHandler_no_copy:
    "\<And>irq sl sl' s. \<lbrakk> isFinal (IRQHandlerCap irq) sl (cteCaps_of s); sl \<noteq> sl' \<rbrakk> \<Longrightarrow> cteCaps_of s sl' \<noteq> Some (IRQHandlerCap irq)" apply (clarsimp simp: isFinal_def sameObjectAs_def2 isCap_simps) apply fastforce done from stuff have stuff':
    "finalise_prop_stuff (no_cte_prop Pr)" by (simp add: no_cte_prop_def finalise_prop_stuff_def) note stuff'[unfolded finalise_prop_stuff_def, simp] show ?case apply (subst finaliseSlot'.simps) apply (fold reduceZombie_def[unfolded cteDelete_def finaliseSlot_def]) apply (unfold split_def) apply (rule hoare_pre_spec_validE) apply (wp | simp)+ apply (wp make_zombie_invs' updateCap_cte_wp_at_cases
                   hoare_vcg_disj_lift)[1] apply (wp hyps) apply ((wp preemptionPoint_invE preemptionPoint_invR
              | clarsimp simp: sch_act_simple_def
              | simp cong: kernel_state.fold_congs machine_state.fold_congs)+)[1] apply (rule spec_strengthen_postE [OF reduceZombie_invs''[OF _ stuff]]) prefer 2 apply fastforce apply (rule hoare_pre_spec_validE,
                rule spec_strengthen_postE) apply (unfold finaliseSlot_def)[1] apply (rule hyps[where P="\<top>" and p=sl], (assumption | rule refl)+) apply clarsimp apply (clarsimp simp: cte_wp_at_ctes_of) apply (wp, simp) apply (wp make_zombie_invs' updateCap_ctes_of_wp updateCap_cap_to'
                  hoare_vcg_disj_lift updateCap_cte_wp_at_cases)+ apply simp apply (rule hoare_strengthen_post) apply (rule_tac Q="\<lambda>fin s. invs' s \<and> sch_act_simple s \<and> s \<turnstile>' (fst fin)
                                 \<and> (exp \<or> ex_cte_cap_to' sl s)
                                 \<and> no_cte_prop Pr s
                                 \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s
                                 \<and> (q = sl \<or> exp \<or> cte_wp_at' (?P) q s)"
                   in hoare_vcg_conj_lift) apply (wp hoare_vcg_disj_lift finaliseCap finaliseCap_invs[where sl=sl]) apply (rule finaliseCap_zombie_cap') apply (rule hoare_vcg_conj_lift) apply (rule finaliseCap_cte_refs) apply (rule finaliseCap_replaceable[where slot=sl]) apply clarsimp apply (erule disjE[where P="F \<and> G" for F G]) apply (clarsimp simp: capRemovable_def cte_wp_at_ctes_of) apply (rule conjI, clarsimp) apply (case_tac b; case_tac "cteCap rv"; simp add: arch_cap_has_cleanup'_def) apply (clarsimp simp: final_IRQHandler_no_copy) apply (clarsimp dest!: isCapDs) apply (rule conjI) apply (clarsimp simp: capRemovable_def) apply (rule conjI) apply (clarsimp simp: cte_wp_at_ctes_of) apply (rule conjI, clarsimp) apply (case_tac "cteCap rv",
                simp_all add: isCap_simps removeable'_def
                              fun_eq_iff[where f="cte_refs' cap" for cap]
                              fun_eq_iff[where f=tcb_cte_cases]
                              tcb_cte_cases_def
                              word_neq_0_conv[symmetric])[1] apply (clarsimp simp: cte_wp_at_ctes_of) apply (rule conjI, clarsimp) apply (case_tac "cteCap rv",
               simp_all add: isCap_simps removeable'_def
                             fun_eq_iff[where f="cte_refs' cap" for cap]
                             fun_eq_iff[where f=tcb_cte_cases]
                             tcb_cte_cases_def)[1] apply (frule Q) apply clarsimp apply (subst(asm) R) apply (drule valid_capAligned [OF ctes_of_valid']) apply fastforce apply (simp add: capAligned_def word_bits_def) apply (frule Q) apply clarsimp apply (clarsimp simp: cte_wp_at_ctes_of capRemovable_def) apply (subgoal_tac "final_matters' (cteCap rv) \<and> \<not> isUntypedCap (cteCap rv)") apply clarsimp apply (rule conjI) apply clarsimp apply clarsimp apply (case_tac "cteCap rv",
              simp_all add: isCap_simps final_matters'_def)[1] apply (wp isFinalCapability_inv hoare_weak_lift_imp | simp | wp (once) isFinal[where x=sl])+ apply (wp getCTE_wp') apply (clarsimp simp: cte_wp_at_ctes_of) apply (rule conjI, clarsimp simp: removeable'_def) apply (clarsimp simp: conj_comms) apply (rule conjI, erule ctes_of_valid', clarsimp) apply (rule conjI, clarsimp) apply fastforce done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. st \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exposed \<or> ex_cte_cap_wp_to' (\<lambda>_. True) slot s) \<and> (exposed \<or> p = slot \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' slot exposed \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exposed \<or> p = slot \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' slot s (cteCap cte)) slot s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> slot \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace> proof (state)
goal (1 subgoal):
 1. \<And>x b s P p. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc xa xb y xaa xab xac v sa s' P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); xa = (fst rvb, b); (xb, y) = xa; \<not> (isZombie xb \<and> capZombieNumber xb = 0); \<not> (isZombie xb \<and> \<not> y); isZombie xb \<and> y; xaa = xb; xab = capZombiePtr xaa; xac = capZombieNumber xaa; (Inr v, s') \<in> fst ((withoutPreemption $ locateSlotCap xaa (fromIntegral (xac - 1))) sa)\<rbrakk> \<Longrightarrow> s' \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) v s) \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' v False \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' v s (cteCap cte)) v s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> v \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); (Inr rvd, std) \<in> fst ((let (v33, v34) = (fst rvb, b) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> x) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr x
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE x;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap x
od else haskell_assertE (ptr2 = x \<and> ptr \<noteq> x) [] else haskell_fail []
odE else haskell_fail []) stc); (Inr rve, ste) \<in> fst (preemptionPoint std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace> proof (state)
this:
\<lbrakk>(Inr ?rv, ?st) \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap ?rv); (Inr ?rva, ?sta) \<in> fst ((withoutPreemption $ isFinalCapability ?rv) ?st); (Inr ?rvb, ?stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap ?rv) ?rva False) ?sta); \<not> capRemovable (fst ?rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst ?rvb) sl); (Inr ?rvc, ?stc) \<in> fst ((withoutPreemption $ updateCap sl (fst ?rvb)) ?stb); ?xa = (fst ?rvb, exp); (?xb, ?y) = ?xa; \<not> (isZombie ?xb \<and> capZombieNumber ?xb = 0); \<not> (isZombie ?xb \<and> \<not> ?y); isZombie ?xb \<and> ?y; ?xaa = ?xb; ?xab = capZombiePtr ?xaa; ?xac = capZombieNumber ?xaa; (Inr ?v, ?s') \<in> fst ((withoutPreemption $ locateSlotCap ?xaa (fromIntegral (?xac - 1))) ?sa)\<rbrakk> \<Longrightarrow> ?s' \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) ?v s) \<and> (False \<or> ?p = ?v \<or> cte_wp_at' (\<lambda>cte. (?P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie ?p zb n \<and> ?P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> ?p))) ?p s)\<rbrace> finaliseSlot' ?v False \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> ?p = ?v \<or> cte_wp_at' (\<lambda>cte. (?P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie ?p zb n \<and> ?P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> ?p))) ?p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' ?v s (cteCap cte)) ?v s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> ?v \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
\<lbrakk>(Inr ?rv, ?st) \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap ?rv); (Inr ?rva, ?sta) \<in> fst ((withoutPreemption $ isFinalCapability ?rv) ?st); (Inr ?rvb, ?stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap ?rv) ?rva False) ?sta); \<not> capRemovable (fst ?rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst ?rvb) sl); (Inr ?rvc, ?stc) \<in> fst ((withoutPreemption $ updateCap sl (fst ?rvb)) ?stb); (Inr ?rvd, ?std) \<in> fst ((let (v33, v34) = (fst ?rvb, exp) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr sl
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE sl;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap sl
od else haskell_assertE (ptr2 = sl \<and> ptr \<noteq> sl) [] else haskell_fail []
odE else haskell_fail []) ?stc); (Inr ?rve, ?ste) \<in> fst (preemptionPoint ?std)\<rbrakk> \<Longrightarrow> ?ste \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> ?p = sl \<or> cte_wp_at' (\<lambda>cte. (?P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie ?p zb n \<and> ?P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> ?p))) ?p s)\<rbrace> finaliseSlot' sl exp \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ?p = sl \<or> cte_wp_at' (\<lambda>cte. (?P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie ?p zb n \<and> ?P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> ?p))) ?p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>

goal (1 subgoal):
 1. \<And>x b s P p. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc xa xb y xaa xab xac v sa s' P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); xa = (fst rvb, b); (xb, y) = xa; \<not> (isZombie xb \<and> capZombieNumber xb = 0); \<not> (isZombie xb \<and> \<not> y); isZombie xb \<and> y; xaa = xb; xab = capZombiePtr xaa; xac = capZombieNumber xaa; (Inr v, s') \<in> fst ((withoutPreemption $ locateSlotCap xaa (fromIntegral (xac - 1))) sa)\<rbrakk> \<Longrightarrow> s' \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) v s) \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' v False \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' v s (cteCap cte)) v s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> v \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); (Inr rvd, std) \<in> fst ((let (v33, v34) = (fst rvb, b) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> x) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr x
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE x;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap x
od else haskell_assertE (ptr2 = x \<and> ptr \<noteq> x) [] else haskell_fail []
odE else haskell_fail []) stc); (Inr rve, ste) \<in> fst (preemptionPoint std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace> proof (state)
goal (1 subgoal):
 1. \<And>x b s P p. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc xa xb y xaa xab xac v sa s' P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); xa = (fst rvb, b); (xb, y) = xa; \<not> (isZombie xb \<and> capZombieNumber xb = 0); \<not> (isZombie xb \<and> \<not> y); isZombie xb \<and> y; xaa = xb; xab = capZombiePtr xaa; xac = capZombieNumber xaa; (Inr v, s') \<in> fst ((withoutPreemption $ locateSlotCap xaa (fromIntegral (xac - 1))) sa)\<rbrakk> \<Longrightarrow> s' \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) v s) \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' v False \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' v s (cteCap cte)) v s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> v \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); (Inr rvd, std) \<in> fst ((let (v33, v34) = (fst rvb, b) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> x) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr x
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE x;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap x
od else haskell_assertE (ptr2 = x \<and> ptr \<noteq> x) [] else haskell_fail []
odE else haskell_fail []) stc); (Inr rve, ste) \<in> fst (preemptionPoint std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace> proof (state)
this:
\<lbrakk>(Inr ?rv, ?st) \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap ?rv); (Inr ?rva, ?sta) \<in> fst ((withoutPreemption $ isFinalCapability ?rv) ?st); (Inr ?rvb, ?stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap ?rv) ?rva False) ?sta); \<not> capRemovable (fst ?rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst ?rvb) sl); (Inr ?rvc, ?stc) \<in> fst ((withoutPreemption $ updateCap sl (fst ?rvb)) ?stb); ?xa = (fst ?rvb, exp); (?xb, ?y) = ?xa; \<not> (isZombie ?xb \<and> capZombieNumber ?xb = 0); \<not> (isZombie ?xb \<and> \<not> ?y); isZombie ?xb \<and> ?y; ?xaa = ?xb; ?xab = capZombiePtr ?xaa; ?xac = capZombieNumber ?xaa; (Inr ?v, ?s') \<in> fst ((withoutPreemption $ locateSlotCap ?xaa (fromIntegral (?xac - 1))) ?sa)\<rbrakk> \<Longrightarrow> ?s' \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) ?v s) \<and> (False \<or> ?p = ?v \<or> cte_wp_at' (\<lambda>cte. (?P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie ?p zb n \<and> ?P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> ?p))) ?p s)\<rbrace> finaliseSlot' ?v False \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> ?p = ?v \<or> cte_wp_at' (\<lambda>cte. (?P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie ?p zb n \<and> ?P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> ?p))) ?p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' ?v s (cteCap cte)) ?v s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> ?v \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
\<lbrakk>(Inr ?rv, ?st) \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap ?rv); (Inr ?rva, ?sta) \<in> fst ((withoutPreemption $ isFinalCapability ?rv) ?st); (Inr ?rvb, ?stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap ?rv) ?rva False) ?sta); \<not> capRemovable (fst ?rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst ?rvb) sl); (Inr ?rvc, ?stc) \<in> fst ((withoutPreemption $ updateCap sl (fst ?rvb)) ?stb); (Inr ?rvd, ?std) \<in> fst (reduceZombie (fst ?rvb) sl exp ?stc); (Inr ?rve, ?ste) \<in> fst (preemptionPoint ?std)\<rbrakk> \<Longrightarrow> ?ste \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> ?p = sl \<or> cte_wp_at' (\<lambda>cte. (?P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie ?p zb n \<and> ?P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> ?p))) ?p s)\<rbrace> finaliseSlot' sl exp \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ?p = sl \<or> cte_wp_at' (\<lambda>cte. (?P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie ?p zb n \<and> ?P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> ?p))) ?p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>

goal (1 subgoal):
 1. \<And>x b s P p. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc xa xb y xaa xab xac v sa s' P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); xa = (fst rvb, b); (xb, y) = xa; \<not> (isZombie xb \<and> capZombieNumber xb = 0); \<not> (isZombie xb \<and> \<not> y); isZombie xb \<and> y; xaa = xb; xab = capZombiePtr xaa; xac = capZombieNumber xaa; (Inr v, s') \<in> fst ((withoutPreemption $ locateSlotCap xaa (fromIntegral (xac - 1))) sa)\<rbrakk> \<Longrightarrow> s' \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) v s) \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' v False \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' v s (cteCap cte)) v s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> v \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); (Inr rvd, std) \<in> fst ((let (v33, v34) = (fst rvb, b) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> x) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr x
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE x;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap x
od else haskell_assertE (ptr2 = x \<and> ptr \<noteq> x) [] else haskell_fail []
odE else haskell_fail []) stc); (Inr rve, ste) \<in> fst (preemptionPoint std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x y n. {x} = (\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} \<Longrightarrow> n = 1 proof (prove)
goal (1 subgoal):
 1. \<And>x y n. (\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x} \<Longrightarrow> n = 1 proof (prove)
goal (2 subgoals):
 1. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; 1 < n\<rbrakk> \<Longrightarrow> n = 1
 2. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; \<not> 1 < n\<rbrakk> \<Longrightarrow> n = 1 proof (prove)
goal (2 subgoals):
 1. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; 1 < n; (y + 0 * 2 ^ cteSizeBits \<in> (\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n}) = (y + 0 * 2 ^ cteSizeBits \<in> {x})\<rbrakk> \<Longrightarrow> n = 1
 2. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; \<not> 1 < n\<rbrakk> \<Longrightarrow> n = 1 proof (prove)
goal (2 subgoals):
 1. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; 1 < n; (y + 0 * 2 ^ cteSizeBits \<in> (\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n}) = (y + 0 * 2 ^ cteSizeBits \<in> {x}); (y + 1 * 2 ^ cteSizeBits \<in> (\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n}) = (y + 1 * 2 ^ cteSizeBits \<in> {x})\<rbrakk> \<Longrightarrow> n = 1
 2. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; \<not> 1 < n\<rbrakk> \<Longrightarrow> n = 1 proof (prove)
goal (3 subgoals):
 1. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; 1 < n\<rbrakk> \<Longrightarrow> 0 < n
 2. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; 1 < n; True = (y + 0 * 2 ^ cteSizeBits \<in> {x}); (y + 1 * 2 ^ cteSizeBits \<in> (\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n}) = (y + 1 * 2 ^ cteSizeBits \<in> {x})\<rbrakk> \<Longrightarrow> n = 1
 3. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; \<not> 1 < n\<rbrakk> \<Longrightarrow> n = 1 proof (prove)
goal (2 subgoals):
 1. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; 1 < n; True = (y + 0 * 2 ^ cteSizeBits \<in> {x}); (y + 1 * 2 ^ cteSizeBits \<in> (\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n}) = (y + 1 * 2 ^ cteSizeBits \<in> {x})\<rbrakk> \<Longrightarrow> n = 1
 2. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; \<not> 1 < n\<rbrakk> \<Longrightarrow> n = 1 proof (prove)
goal (2 subgoals):
 1. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; 1 < n; True = (y + 0 * 2 ^ cteSizeBits \<in> {x}); True = (y + 1 * 2 ^ cteSizeBits \<in> {x})\<rbrakk> \<Longrightarrow> n = 1
 2. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; \<not> 1 < n\<rbrakk> \<Longrightarrow> n = 1 proof (prove)
goal (2 subgoals):
 1. \<And>x y n. \<lbrakk>(\<lambda>xa. x + xa * 2 ^ cteSizeBits) ` {0..<n} = {x}; 1 < n; y = x; 32 \<le> cteSizeBits\<rbrakk> \<Longrightarrow> n = 1
 2. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; \<not> 1 < n\<rbrakk> \<Longrightarrow> n = 1 proof (prove)
goal (1 subgoal):
 1. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; \<not> 1 < n\<rbrakk> \<Longrightarrow> n = 1 proof (prove)
goal (2 subgoals):
 1. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; \<not> 1 < n; n < 1\<rbrakk> \<Longrightarrow> n = 1
 2. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; \<not> 1 < n; \<not> n < 1\<rbrakk> \<Longrightarrow> n = 1 proof (prove)
goal (1 subgoal):
 1. \<And>x y n. \<lbrakk>(\<lambda>x. y + x * 2 ^ cteSizeBits) ` {0..<n} = {x}; \<not> 1 < n; \<not> n < 1\<rbrakk> \<Longrightarrow> n = 1 proof (prove)
goal:
No subgoals! proof (state)
this:
{?x} = (\<lambda>x. ?y + x * 2 ^ cteSizeBits) ` {0..<?n} \<Longrightarrow> ?n = 1

goal (1 subgoal):
 1. \<And>x b s P p. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc xa xb y xaa xab xac v sa s' P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); xa = (fst rvb, b); (xb, y) = xa; \<not> (isZombie xb \<and> capZombieNumber xb = 0); \<not> (isZombie xb \<and> \<not> y); isZombie xb \<and> y; xaa = xb; xab = capZombiePtr xaa; xac = capZombieNumber xaa; (Inr v, s') \<in> fst ((withoutPreemption $ locateSlotCap xaa (fromIntegral (xac - 1))) sa)\<rbrakk> \<Longrightarrow> s' \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) v s) \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' v False \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' v s (cteCap cte)) v s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> v \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); (Inr rvd, std) \<in> fst ((let (v33, v34) = (fst rvb, b) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> x) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr x
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE x;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap x
od else haskell_assertE (ptr2 = x \<and> ptr \<noteq> x) [] else haskell_fail []
odE else haskell_fail []) stc); (Inr rve, ste) \<in> fst (preemptionPoint std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>n. n \<noteq> 0 \<Longrightarrow> {0..n - 1} = {0..<n} proof (prove)
goal (2 subgoals):
 1. \<And>n x. \<lbrakk>n \<noteq> 0; x \<in> {0..n - 1}\<rbrakk> \<Longrightarrow> x \<in> {0..<n}
 2. \<And>n x. \<lbrakk>n \<noteq> 0; x \<in> {0..<n}\<rbrakk> \<Longrightarrow> x \<in> {0..n - 1} proof (prove)
goal (2 subgoals):
 1. \<And>n x. \<lbrakk>n \<noteq> 0; x \<le> n - 1\<rbrakk> \<Longrightarrow> x < n
 2. \<And>n x. \<lbrakk>n \<noteq> 0; x \<in> {0..<n}\<rbrakk> \<Longrightarrow> x \<in> {0..n - 1} proof (prove)
goal (1 subgoal):
 1. \<And>n x. \<lbrakk>n \<noteq> 0; x \<in> {0..<n}\<rbrakk> \<Longrightarrow> x \<in> {0..n - 1} proof (prove)
goal (1 subgoal):
 1. \<And>n x. \<lbrakk>n \<noteq> 0; x < n\<rbrakk> \<Longrightarrow> x \<le> n - 1 proof (prove)
goal:
No subgoals! proof (state)
this:
?n \<noteq> 0 \<Longrightarrow> {0..?n - 1} = {0..<?n}

goal (1 subgoal):
 1. \<And>x b s P p. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc xa xb y xaa xab xac v sa s' P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); xa = (fst rvb, b); (xb, y) = xa; \<not> (isZombie xb \<and> capZombieNumber xb = 0); \<not> (isZombie xb \<and> \<not> y); isZombie xb \<and> y; xaa = xb; xab = capZombiePtr xaa; xac = capZombieNumber xaa; (Inr v, s') \<in> fst ((withoutPreemption $ locateSlotCap xaa (fromIntegral (xac - 1))) sa)\<rbrakk> \<Longrightarrow> s' \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) v s) \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' v False \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' v s (cteCap cte)) v s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> v \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); (Inr rvd, std) \<in> fst ((let (v33, v34) = (fst rvb, b) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> x) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr x
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE x;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap x
od else haskell_assertE (ptr2 = x \<and> ptr \<noteq> x) [] else haskell_fail []
odE else haskell_fail []) stc); (Inr rve, ste) \<in> fst (preemptionPoint std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>irq sl sl' s. \<lbrakk>isFinal (capability.IRQHandlerCap irq) sl (cteCaps_of s); sl \<noteq> sl'\<rbrakk> \<Longrightarrow> cteCaps_of s sl' \<noteq> Some (capability.IRQHandlerCap irq) proof (prove)
goal (1 subgoal):
 1. \<And>irq sl sl' s. \<lbrakk>\<forall>p' c. cteCaps_of s p' = Some c \<longrightarrow> sl \<noteq> p' \<longrightarrow> (\<forall>d v0 v1 f. c \<noteq> capability.UntypedCap d v0 v1 f) \<longrightarrow> capability.IRQHandlerCap irq = capMasterCap c \<longrightarrow> capMasterCap c = capability.NullCap \<or> (\<exists>v0 v1 v2. capMasterCap c = capability.Zombie v0 v1 v2) \<or> (\<exists>d v0 v1 f. capMasterCap c = capability.UntypedCap d v0 v1 f) \<or> (\<exists>d ref rghts sz data. capMasterCap c = capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) \<and> capRange (capMasterCap c) = {}; sl \<noteq> sl'; cteCaps_of s sl' = Some (capability.IRQHandlerCap irq)\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>isFinal (capability.IRQHandlerCap ?irq) ?sl (cteCaps_of ?s); ?sl \<noteq> ?sl'\<rbrakk> \<Longrightarrow> cteCaps_of ?s ?sl' \<noteq> Some (capability.IRQHandlerCap ?irq)

goal (1 subgoal):
 1. \<And>x b s P p. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc xa xb y xaa xab xac v sa s' P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); xa = (fst rvb, b); (xb, y) = xa; \<not> (isZombie xb \<and> capZombieNumber xb = 0); \<not> (isZombie xb \<and> \<not> y); isZombie xb \<and> y; xaa = xb; xab = capZombiePtr xaa; xac = capZombieNumber xaa; (Inr v, s') \<in> fst ((withoutPreemption $ locateSlotCap xaa (fromIntegral (xac - 1))) sa)\<rbrakk> \<Longrightarrow> s' \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) v s) \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' v False \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' v s (cteCap cte)) v s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> v \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); (Inr rvd, std) \<in> fst ((let (v33, v34) = (fst rvb, b) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> x) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr x
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE x;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap x
od else haskell_assertE (ptr2 = x \<and> ptr \<noteq> x) [] else haskell_fail []
odE else haskell_fail []) stc); (Inr rve, ste) \<in> fst (preemptionPoint std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace> proof (chain)
picking this:
finalise_prop_stuff Pr proof (prove)
using this:
finalise_prop_stuff Pr

goal (1 subgoal):
 1. finalise_prop_stuff (no_cte_prop Pr) proof (state)
this:
finalise_prop_stuff (no_cte_prop Pr)

goal (1 subgoal):
 1. \<And>x b s P p. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc xa xb y xaa xab xac v sa s' P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); xa = (fst rvb, b); (xb, y) = xa; \<not> (isZombie xb \<and> capZombieNumber xb = 0); \<not> (isZombie xb \<and> \<not> y); isZombie xb \<and> y; xaa = xb; xab = capZombiePtr xaa; xac = capZombieNumber xaa; (Inr v, s') \<in> fst ((withoutPreemption $ locateSlotCap xaa (fromIntegral (xac - 1))) sa)\<rbrakk> \<Longrightarrow> s' \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) v s) \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' v False \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' v s (cteCap cte)) v s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> v \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); (Inr rvd, std) \<in> fst ((let (v33, v34) = (fst rvb, b) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> x) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr x
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE x;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap x
od else haskell_assertE (ptr2 = x \<and> ptr \<noteq> x) [] else haskell_fail []
odE else haskell_fail []) stc); (Inr rve, ste) \<in> fst (preemptionPoint std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace> proof (state)
this:
(\<forall>s f. no_cte_prop Pr (ksWorkUnitsCompleted_update f s) = no_cte_prop Pr s) \<and> irq_state_independent_H (no_cte_prop Pr) \<and> (\<forall>s f. no_cte_prop Pr (gsUntypedZeroRanges_update f s) = no_cte_prop Pr s) \<and> (\<forall>s f. no_cte_prop Pr (ksInterruptState_update f s) = no_cte_prop Pr s) \<and> (\<forall>s f. no_cte_prop Pr (ksMachineState_update (irq_state_update f) s) = no_cte_prop Pr s) \<and> (\<forall>s f. no_cte_prop Pr (ksMachineState_update (irq_masks_update f) s) = no_cte_prop Pr s)

goal (1 subgoal):
 1. \<And>x b s P p. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc xa xb y xaa xab xac v sa s' P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); xa = (fst rvb, b); (xb, y) = xa; \<not> (isZombie xb \<and> capZombieNumber xb = 0); \<not> (isZombie xb \<and> \<not> y); isZombie xb \<and> y; xaa = xb; xab = capZombiePtr xaa; xac = capZombieNumber xaa; (Inr v, s') \<in> fst ((withoutPreemption $ locateSlotCap xaa (fromIntegral (xac - 1))) sa)\<rbrakk> \<Longrightarrow> s' \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) v s) \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' v False \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (False \<or> p = v \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' v s (cteCap cte)) v s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> v \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste P p. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); (Inr rvd, std) \<in> fst ((let (v33, v34) = (fst rvb, b) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> x) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr x
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE x;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap x
od else haskell_assertE (ptr2 = x \<and> ptr \<noteq> x) [] else haskell_fail []
odE else haskell_fail []) stc); (Inr rve, ste) \<in> fst (preemptionPoint std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x s) \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (b \<or> p = x \<or> cte_wp_at' (\<lambda>cte. (P and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie p zb n \<and> P cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> p))) p s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' x s (cteCap cte)) x s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> x \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace> proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace> finaliseSlot' sl exp \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace> proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace> doE cte <- withoutPreemption $ getCTE sl;
if isNullCap $ cteCap cte then returnOk (True, capability.NullCap) else doE final <- withoutPreemption $ isFinalCapability cte;
(remainder, info) <- withoutPreemption $ global.finaliseCap (cteCap cte) final False;
if capRemovable remainder sl then returnOk (True, info) else if \<not> exp \<and> capCyclicZombie remainder sl then doE withoutPreemption $ updateCap sl remainder;
returnOk (False, capability.NullCap)
odE else doE withoutPreemption $ updateCap sl remainder;
let (v33, v34) = (remainder, exp) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr sl
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE sl;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap sl
od else haskell_assertE (ptr2 = sl \<and> ptr \<noteq> sl) [] else haskell_fail []
odE else haskell_fail [];
preemptionPoint;
finaliseSlot' sl exp
odE
odE
odE \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace> proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace> doE cte <- withoutPreemption $ getCTE sl;
if isNullCap $ cteCap cte then returnOk (True, capability.NullCap) else doE final <- withoutPreemption $ isFinalCapability cte;
(remainder, info) <- withoutPreemption $ global.finaliseCap (cteCap cte) final False;
if capRemovable remainder sl then returnOk (True, info) else if \<not> exp \<and> capCyclicZombie remainder sl then doE withoutPreemption $ updateCap sl remainder;
returnOk (False, capability.NullCap)
odE else doE withoutPreemption $ updateCap sl remainder;
reduceZombie remainder sl exp;
preemptionPoint;
finaliseSlot' sl exp
odE
odE
odE \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace> proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace> doE cte <- withoutPreemption $ getCTE sl;
if isNullCap $ cteCap cte then returnOk (True, capability.NullCap) else doE final <- withoutPreemption $ isFinalCapability cte;
p <- withoutPreemption $ global.finaliseCap (cteCap cte) final False;
if capRemovable (fst p) sl then returnOk (True, snd p) else if \<not> exp \<and> capCyclicZombie (fst p) sl then doE withoutPreemption $ updateCap sl (fst p);
returnOk (False, capability.NullCap)
odE else doE withoutPreemption $ updateCap sl (fst p);
reduceZombie (fst p) sl exp;
preemptionPoint;
finaliseSlot' sl exp
odE
odE
odE \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace> proof (prove)
goal (2 subgoals):
 1. s \<turnstile> \<lbrace>?P'\<rbrace> doE cte <- withoutPreemption $ getCTE sl;
if isNullCap $ cteCap cte then returnOk (True, capability.NullCap) else doE final <- withoutPreemption $ isFinalCapability cte;
p <- withoutPreemption $ global.finaliseCap (cteCap cte) final False;
if capRemovable (fst p) sl then returnOk (True, snd p) else if \<not> exp \<and> capCyclicZombie (fst p) sl then doE withoutPreemption $ updateCap sl (fst p);
returnOk (False, capability.NullCap)
odE else doE withoutPreemption $ updateCap sl (fst p);
reduceZombie (fst p) sl exp;
preemptionPoint;
finaliseSlot' sl exp
odE
odE
odE \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 2. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (rvb, s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable (fst rvb) sl; \<not> exp \<and> capCyclicZombie (fst rvb) sl\<rbrakk> \<Longrightarrow> \<lbrace>?P'36 rv s'' rva s''a rvb\<rbrace> updateCap sl (fst rvb) \<lbrace>\<lambda>rv s. invs' s \<and> sch_act_simple s \<and> (q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'25 rv s'' rva s''a rvb\<rbrace> doE withoutPreemption $ updateCap sl (fst rvb);
reduceZombie (fst rvb) sl exp;
preemptionPoint;
finaliseSlot' sl exp
odE \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B12 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, snd rvb) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, snd rvb) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> ?P'36 rv s'' rva s''a rvb s) \<and> (\<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'25 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'25 rv s'' rva s''a rvb\<rbrace> doE withoutPreemption $ updateCap sl (fst rvb);
reduceZombie (fst rvb) sl exp;
preemptionPoint;
finaliseSlot' sl exp
odE \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B12 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, snd rvb) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, snd rvb) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> (invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s) \<and> sch_act_simple s \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (K (fst rvb))) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))) \<and> (\<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'25 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); (Inr rvd, s''d) \<in> fst (reduceZombie (fst rvb) sl exp s''c)\<rbrakk> \<Longrightarrow> s''d \<turnstile> \<lbrace>?B77 rv s'' rva s''a rvb s''b rvc s''c rvd\<rbrace> preemptionPoint \<lbrace>\<lambda>rve s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?B75 rv s'' rva s''a rvb s''b rvc\<rbrace> reduceZombie (fst rvb) sl exp \<lbrace>?B77 rv s'' rva s''a rvb s''b rvc s''c\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'25 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>?B75 rv s'' rva s''a rvb s''b\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B12 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, snd rvb) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, snd rvb) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> (invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s) \<and> sch_act_simple s \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (K (fst rvb))) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))) \<and> (\<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'25 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 7. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?B75 rv s'' rva s''a rvb s''b rvc\<rbrace> reduceZombie (fst rvb) sl exp \<lbrace>\<lambda>rvd s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'25 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>?B75 rv s'' rva s''a rvb s''b\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B12 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, snd rvb) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, snd rvb) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> (invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s) \<and> sch_act_simple s \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (K (fst rvb))) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))) \<and> (\<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'25 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c s''d rvd. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> exp); isZombie (fst rvb) \<and> exp; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c)\<rbrakk> \<Longrightarrow> s''d \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>cte. isZombie (cteCap cte)) sl s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rvd s\<rbrace> finaliseSlot rvd False \<lbrace>\<lambda>rva s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (fst rva \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' rvd s (cteCap cte)) rvd s) \<and> (\<forall>sl'. snd rva \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> rvd \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rva))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c sa r. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); no_cte_prop Pr r \<and> invs' r \<and> sch_act_simple r \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl r) \<and> (exp \<or> ?p120 rv s'' rva s''a rvb s''b rvc = sl \<or> cte_wp_at' (\<lambda>cte. (?P118 rv s'' rva s''a rvb s''b rvc and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie (?p120 rv s'' rva s''a rvb s''b rvc) zb n \<and> ?P118 rv s'' rva s''a rvb s''b rvc cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> ?p120 rv s'' rva s''a rvb s''b rvc))) (?p120 rv s'' rva s''a rvb s''b rvc) r)\<rbrakk> \<Longrightarrow> no_cte_prop Pr r \<and> invs' r \<and> sch_act_simple r \<and> no_cte_prop Pr r \<and> invs' r \<and> sch_act_simple r \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl r) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q r)
 3. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'25 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) sl s \<and> (exp \<or> ?p120 rv s'' rva s''a rvb s''b rvc = sl \<or> cte_wp_at' (\<lambda>cte. (?P118 rv s'' rva s''a rvb s''b rvc and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie (?p120 rv s'' rva s''a rvb s''b rvc) zb n \<and> ?P118 rv s'' rva s''a rvb s''b rvc cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> ?p120 rv s'' rva s''a rvb s''b rvc))) (?p120 rv s'' rva s''a rvb s''b rvc) s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B12 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, snd rvb) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, snd rvb) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> (invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s) \<and> sch_act_simple s \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (K (fst rvb))) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))) \<and> (\<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'25 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 7. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c sa r. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); no_cte_prop Pr r \<and> invs' r \<and> sch_act_simple r \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl r) \<and> (exp \<or> ?p120 rv s'' rva s''a rvb s''b rvc = sl \<or> cte_wp_at' (\<lambda>cte. (?P118 rv s'' rva s''a rvb s''b rvc and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie (?p120 rv s'' rva s''a rvb s''b rvc) zb n \<and> ?P118 rv s'' rva s''a rvb s''b rvc cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> ?p120 rv s'' rva s''a rvb s''b rvc))) (?p120 rv s'' rva s''a rvb s''b rvc) r)\<rbrakk> \<Longrightarrow> no_cte_prop Pr r \<and> invs' r \<and> sch_act_simple r \<and> no_cte_prop Pr r \<and> invs' r \<and> sch_act_simple r \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl r) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q r)
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c s''d rvd. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> exp); isZombie (fst rvb) \<and> exp; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c)\<rbrakk> \<Longrightarrow> s''d \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>cte. isZombie (cteCap cte)) sl s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rvd s\<rbrace> finaliseSlot rvd False \<lbrace>\<lambda>rva s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (fst rva \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' rvd s (cteCap cte)) rvd s) \<and> (\<forall>sl'. snd rva \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> rvd \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rva))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'25 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) sl s \<and> (exp \<or> ?p120 rv s'' rva s''a rvb s''b rvc = sl \<or> cte_wp_at' (\<lambda>cte. (?P118 rv s'' rva s''a rvb s''b rvc and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie (?p120 rv s'' rva s''a rvb s''b rvc) zb n \<and> ?P118 rv s'' rva s''a rvb s''b rvc cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> ?p120 rv s'' rva s''a rvb s''b rvc))) (?p120 rv s'' rva s''a rvb s''b rvc) s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B12 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, snd rvb) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, snd rvb) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> (invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s) \<and> sch_act_simple s \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (K (fst rvb))) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))) \<and> (\<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'25 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 7. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c s''d rvd. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> exp); isZombie (fst rvb) \<and> exp; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c)\<rbrakk> \<Longrightarrow> s''d \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>cte. isZombie (cteCap cte)) sl s \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rvd s\<rbrace> finaliseSlot rvd False \<lbrace>\<lambda>rva s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (fst rva \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' rvd s (cteCap cte)) rvd s) \<and> (\<forall>sl'. snd rva \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> rvd \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rva))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'25 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) sl s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B12 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, snd rvb) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, snd rvb) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> (invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s) \<and> sch_act_simple s \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (K (fst rvb))) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))) \<and> (\<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'25 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (8 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c s''d rvd. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> exp); isZombie (fst rvb) \<and> exp; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c)\<rbrakk> \<Longrightarrow> s''d \<turnstile> \<lbrace>?P'324 rv s'' rva s''a rvb s''b rvc s''c s''d rvd\<rbrace> finaliseSlot rvd False \<lbrace>?Q'327 rv s'' rva s''a rvb s''b rvc s''c s''d rvd\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c s''d rvd sa r. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> exp); isZombie (fst rvb) \<and> exp; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c); ?Q'327 rv s'' rva s''a rvb s''b rvc s''c s''d rvd sa r\<rbrakk> \<Longrightarrow> no_cte_prop Pr r \<and> invs' r \<and> sch_act_simple r \<and> (fst sa \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' rvd r (cteCap cte)) rvd r) \<and> (\<forall>sl'. snd sa \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> rvd \<longrightarrow> cteCaps_of r sl' \<noteq> Some (snd sa))
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c s''d rvd. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> exp); isZombie (fst rvb) \<and> exp; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c); no_cte_prop Pr s''d \<and> invs' s''d \<and> sch_act_simple s''d \<and> cte_wp_at' (\<lambda>cte. isZombie (cteCap cte)) sl s''d \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rvd s''d\<rbrakk> \<Longrightarrow> ?P'324 rv s'' rva s''a rvb s''b rvc s''c s''d rvd s''d
 4. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'25 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) sl s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B12 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, snd rvb) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, snd rvb) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> (invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s) \<and> sch_act_simple s \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (K (fst rvb))) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))) \<and> (\<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'25 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 7. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 8. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (8 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c s''d rvd. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> exp); isZombie (fst rvb) \<and> exp; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c)\<rbrakk> \<Longrightarrow> s''d \<turnstile> \<lbrace>?P'324 rv s'' rva s''a rvb s''b rvc s''c s''d rvd\<rbrace> finaliseSlot' rvd False \<lbrace>?Q'327 rv s'' rva s''a rvb s''b rvc s''c s''d rvd\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c s''d rvd sa r. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> exp); isZombie (fst rvb) \<and> exp; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c); ?Q'327 rv s'' rva s''a rvb s''b rvc s''c s''d rvd sa r\<rbrakk> \<Longrightarrow> no_cte_prop Pr r \<and> invs' r \<and> sch_act_simple r \<and> (fst sa \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' rvd r (cteCap cte)) rvd r) \<and> (\<forall>sl'. snd sa \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> rvd \<longrightarrow> cteCaps_of r sl' \<noteq> Some (snd sa))
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c s''d rvd. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> exp); isZombie (fst rvb) \<and> exp; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c); no_cte_prop Pr s''d \<and> invs' s''d \<and> sch_act_simple s''d \<and> cte_wp_at' (\<lambda>cte. isZombie (cteCap cte)) sl s''d \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rvd s''d\<rbrakk> \<Longrightarrow> ?P'324 rv s'' rva s''a rvb s''b rvc s''c s''d rvd s''d
 4. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'25 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) sl s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B12 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, snd rvb) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, snd rvb) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> (invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s) \<and> sch_act_simple s \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (K (fst rvb))) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))) \<and> (\<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'25 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 7. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 8. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c s''d rvd sa r. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> exp); isZombie (fst rvb) \<and> exp; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c); no_cte_prop Pr r \<and> invs' r \<and> sch_act_simple r \<and> (False \<or> sl = rvd \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. True) and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie sl zb n \<and> True \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> sl))) sl r) \<and> (fst sa \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' rvd r (cteCap cte)) rvd r) \<and> (\<forall>sl'. snd sa \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> rvd \<longrightarrow> cteCaps_of r sl' \<noteq> Some (snd sa))\<rbrakk> \<Longrightarrow> no_cte_prop Pr r \<and> invs' r \<and> sch_act_simple r \<and> (fst sa \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' rvd r (cteCap cte)) rvd r) \<and> (\<forall>sl'. snd sa \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> rvd \<longrightarrow> cteCaps_of r sl' \<noteq> Some (snd sa))
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c s''d rvd. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> exp); isZombie (fst rvb) \<and> exp; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c); no_cte_prop Pr s''d \<and> invs' s''d \<and> sch_act_simple s''d \<and> cte_wp_at' (\<lambda>cte. isZombie (cteCap cte)) sl s''d \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rvd s''d\<rbrakk> \<Longrightarrow> no_cte_prop Pr s''d \<and> invs' s''d \<and> sch_act_simple s''d \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) rvd s''d) \<and> (False \<or> sl = rvd \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. True) and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie sl zb n \<and> True \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> sl))) sl s''d)
 3. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'25 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) sl s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B12 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, snd rvb) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, snd rvb) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> (invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s) \<and> sch_act_simple s \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (K (fst rvb))) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))) \<and> (\<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'25 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 7. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c s''d rvd. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> exp); isZombie (fst rvb) \<and> exp; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c); no_cte_prop Pr s''d \<and> invs' s''d \<and> sch_act_simple s''d \<and> cte_wp_at' (\<lambda>cte. isZombie (cteCap cte)) sl s''d \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rvd s''d\<rbrakk> \<Longrightarrow> no_cte_prop Pr s''d \<and> invs' s''d \<and> sch_act_simple s''d \<and> (False \<or> ex_cte_cap_wp_to' (\<lambda>_. True) rvd s''d) \<and> (False \<or> sl = rvd \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. True) and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie sl zb n \<and> True \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> sl))) sl s''d)
 2. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'25 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) sl s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B12 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, snd rvb) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, snd rvb) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> (invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s) \<and> sch_act_simple s \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (K (fst rvb))) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))) \<and> (\<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'25 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'25 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) sl s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B12 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, snd rvb) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, snd rvb) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> (invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s) \<and> sch_act_simple s \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (K (fst rvb))) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))) \<and> (\<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'25 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (rvb, s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable (fst rvb) sl; exp \<or> \<not> capCyclicZombie (fst rvb) sl\<rbrakk> \<Longrightarrow> \<lbrace>?P'25 rv s'' rva s''a rvb\<rbrace> updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) sl s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B12 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, snd rvb) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, snd rvb) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> (invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s) \<and> sch_act_simple s \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (K (fst rvb))) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))) \<and> (\<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'25 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> \<lbrace>?B12 rv s'' rva\<rbrace> withoutPreemption (global.finaliseCap (cteCap rv) rva False) \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, snd rvb) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, snd rvb) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> (invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s) \<and> sch_act_simple s \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (K (fst rvb))) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))) \<and> (\<not> (\<not> exp \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> no_cte_prop Pr s \<and> (invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s) \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s \<and> cte_wp_at' (\<lambda>cte. sl \<notin> cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s)) sl s) \<and> ((sl = sl \<longrightarrow> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (K (fst rvb))) sl s) \<and> (sl \<noteq> sl \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) sl s)) \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (K (fst rvb))) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?B12 rv s'' rva\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s \<and> (snd rvb \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s \<and> sch_act_simple s \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))) \<and> (exp \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s \<and> sch_act_simple s \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl s) \<and> (\<not> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> valid_cap' (fst rvb) s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' (fst rvb) (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' s) \<longrightarrow> sl \<in> cte_refs' (fst rvb) (irq_node' s)) sl s) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl s \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q s) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s))))\<rbrace>
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?B12 rv s'' rva\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q440 rv s'' rva s''a\<rbrace>
 2. \<And>rv s'' rva s''a rvb sa. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); ?Q440 rv s'' rva s''a rvb sa\<rbrakk> \<Longrightarrow> (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> sch_act_simple sa \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa \<and> (snd rvb \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some (snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl sa) \<and> (\<not> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (fst rvb) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B12 rv s''\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P445 rv s'' rva\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>fin s. invs' s \<and> sch_act_simple s \<and> valid_cap' (fst fin) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> no_cte_prop Pr s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P'446 rv s'' rva\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q'443 rv s'' rva s''a\<rbrace>
 3. \<And>rv s'' rva s''a rvb sa. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (invs' sa \<and> sch_act_simple sa \<and> valid_cap' (fst rvb) sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa) \<and> no_cte_prop Pr sa \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)) \<and> ?Q'443 rv s'' rva s''a rvb sa\<rbrakk> \<Longrightarrow> (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> sch_act_simple sa \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa \<and> (snd rvb \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some (snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl sa) \<and> (\<not> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (fst rvb) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ?P445 rv s'' rva s \<and> ?P'446 rv s'' rva s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P'491 rv s'' rva\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rv. cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P'446 rv s'' rva\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q'443 rv s'' rva s''a\<rbrace>
 3. \<And>rv s'' rva s''a rvb sa. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (invs' sa \<and> sch_act_simple sa \<and> valid_cap' (fst rvb) sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa) \<and> no_cte_prop Pr sa \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)) \<and> ?Q'443 rv s'' rva s''a rvb sa\<rbrakk> \<Longrightarrow> (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> sch_act_simple sa \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa \<and> (snd rvb \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some (snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl sa) \<and> (\<not> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (fst rvb) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> ?P'491 rv s'' rva s)) \<and> ?P'446 rv s'' rva s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P'446 rv s'' rva\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q'443 rv s'' rva s''a\<rbrace>
 2. \<And>rv s'' rva s''a rvb sa. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (invs' sa \<and> sch_act_simple sa \<and> valid_cap' (fst rvb) sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa) \<and> no_cte_prop Pr sa \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)) \<and> ?Q'443 rv s'' rva s''a rvb sa\<rbrakk> \<Longrightarrow> (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> sch_act_simple sa \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa \<and> (snd rvb \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some (snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl sa) \<and> (\<not> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (fst rvb) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> ?P'446 rv s'' rva s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P496 rv s'' rva\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q495 rv s'' rva s''a\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P'497 rv s'' rva\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q'495 rv s'' rva s''a\<rbrace>
 3. \<And>rv s'' rva s''a rvb sa. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (invs' sa \<and> sch_act_simple sa \<and> valid_cap' (fst rvb) sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa) \<and> no_cte_prop Pr sa \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)) \<and> ?Q495 rv s'' rva s''a rvb sa \<and> ?Q'495 rv s'' rva s''a rvb sa\<rbrakk> \<Longrightarrow> (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> sch_act_simple sa \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa \<and> (snd rvb \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some (snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl sa) \<and> (\<not> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (fst rvb) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> ?P496 rv s'' rva s \<and> ?P'497 rv s'' rva s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P'497 rv s'' rva\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q'495 rv s'' rva s''a\<rbrace>
 2. \<And>rv s'' rva s''a rvb sa. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (invs' sa \<and> sch_act_simple sa \<and> valid_cap' (fst rvb) sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa) \<and> no_cte_prop Pr sa \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)) \<and> (fst rvb \<noteq> capability.NullCap \<longrightarrow> cte_refs' (fst rvb) = cte_refs' (cteCap rv)) \<and> ?Q'495 rv s'' rva s''a rvb sa\<rbrakk> \<Longrightarrow> (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> sch_act_simple sa \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa \<and> (snd rvb \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some (snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl sa) \<and> (\<not> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (fst rvb) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> ?P'497 rv s'' rva s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a rvb sa. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (invs' sa \<and> sch_act_simple sa \<and> valid_cap' (fst rvb) sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa) \<and> no_cte_prop Pr sa \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)) \<and> (fst rvb \<noteq> capability.NullCap \<longrightarrow> cte_refs' (fst rvb) = cte_refs' (cteCap rv)) \<and> (isNullCap (fst rvb) \<and> removeable' sl sa (cteCap rv) \<and> (snd rvb \<noteq> capability.NullCap \<longrightarrow> snd rvb = cteCap rv \<and> cap_has_cleanup' (cteCap rv) \<and> isFinal (cteCap rv) sl (cteCaps_of sa)) \<or> isZombie (fst rvb) \<and> snd rvb = capability.NullCap \<and> isFinal (cteCap rv) sl (cteCaps_of sa) \<and> capClass (cteCap rv) = capClass (fst rvb) \<and> global.capUntypedPtr (fst rvb) = global.capUntypedPtr (cteCap rv) \<and> capBits (fst rvb) = capBits (cteCap rv) \<and> capRange (fst rvb) = capRange (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>pr. p \<notin> set (ksReadyQueues sa pr))))\<rbrakk> \<Longrightarrow> (capRemovable (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> sch_act_simple sa \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa \<and> (snd rvb \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some (snd rvb)))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl sa) \<and> (\<not> capCyclicZombie (fst rvb) sl \<longrightarrow> no_cte_prop Pr sa \<and> invs' sa \<and> valid_cap' (fst rvb) sa \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (fst rvb) \<and> capBits (cteCap cte) = capBits (fst rvb) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (fst rvb) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie (fst rvb) \<or> isThreadCap (fst rvb) \<or> isCNodeCap (fst rvb)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> sch_act_simple sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (fst rvb) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. fst rvb)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a a b sa. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' a sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv); a = capability.NullCap \<and> removeable' sl sa (cteCap rv) \<and> (b \<noteq> capability.NullCap \<longrightarrow> b = cteCap rv \<and> cap_has_cleanup' (cteCap rv) \<and> isFinal (cteCap rv) sl (cteCaps_of sa)) \<or> isZombie a \<and> b = capability.NullCap \<and> isFinal (cteCap rv) sl (cteCaps_of sa) \<and> capClass (cteCap rv) = capClass a \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv) \<and> capBits a = capBits (cteCap rv) \<and> capRange a = capRange (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))\<rbrakk> \<Longrightarrow> (capRemovable a sl \<longrightarrow> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa \<and> (b \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some b))) \<and> (\<not> capRemovable a sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie a sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. a)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) sl sa) \<and> (\<not> capCyclicZombie a sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' a (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. a)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a a b sa. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' a sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv); a = capability.NullCap \<and> removeable' sl sa (cteCap rv) \<and> (b \<noteq> capability.NullCap \<longrightarrow> b = cteCap rv \<and> cap_has_cleanup' (cteCap rv) \<and> isFinal (cteCap rv) sl (cteCaps_of sa))\<rbrakk> \<Longrightarrow> (capRemovable a sl \<longrightarrow> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa \<and> (b \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some b))) \<and> (\<not> capRemovable a sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie a sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. a)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) sl sa) \<and> (\<not> capCyclicZombie a sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' a (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. a)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))))
 2. \<And>rv s'' rva s''a a b sa. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' a sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv); isZombie a \<and> b = capability.NullCap \<and> isFinal (cteCap rv) sl (cteCaps_of sa) \<and> capClass (cteCap rv) = capClass a \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv) \<and> capBits a = capBits (cteCap rv) \<and> capRange a = capRange (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))\<rbrakk> \<Longrightarrow> (capRemovable a sl \<longrightarrow> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa \<and> (b \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some b))) \<and> (\<not> capRemovable a sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie a sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. a)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) sl sa) \<and> (\<not> capCyclicZombie a sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' a (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. a)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a b sa cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); removeable' sl sa (cteCap rv); b \<noteq> capability.NullCap \<longrightarrow> b = cteCap rv \<and> cap_has_cleanup' (cteCap rv) \<and> isFinal (cteCap rv) sl (cteCaps_of sa); ctes_of sa sl = Some cte; cteCap cte = cteCap rv\<rbrakk> \<Longrightarrow> (exp \<or> q = sl \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))))) \<and> (b \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some b))
 2. \<And>rv s'' rva s''a a b sa. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' a sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv); isZombie a \<and> b = capability.NullCap \<and> isFinal (cteCap rv) sl (cteCaps_of sa) \<and> capClass (cteCap rv) = capClass a \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv) \<and> capBits a = capBits (cteCap rv) \<and> capRange a = capRange (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))\<rbrakk> \<Longrightarrow> (capRemovable a sl \<longrightarrow> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa \<and> (b \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some b))) \<and> (\<not> capRemovable a sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie a sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. a)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) sl sa) \<and> (\<not> capCyclicZombie a sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' a (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. a)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a b sa cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); removeable' sl sa (cteCap rv); b \<noteq> capability.NullCap \<longrightarrow> b = cteCap rv \<and> cap_has_cleanup' (cteCap rv) \<and> isFinal (cteCap rv) sl (cteCaps_of sa); ctes_of sa sl = Some cte; cteCap cte = cteCap rv\<rbrakk> \<Longrightarrow> b \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some b)
 2. \<And>rv s'' rva s''a a b sa. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' a sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv); isZombie a \<and> b = capability.NullCap \<and> isFinal (cteCap rv) sl (cteCaps_of sa) \<and> capClass (cteCap rv) = capClass a \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv) \<and> capBits a = capBits (cteCap rv) \<and> capRange a = capRange (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))\<rbrakk> \<Longrightarrow> (capRemovable a sl \<longrightarrow> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa \<and> (b \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some b))) \<and> (\<not> capRemovable a sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie a sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. a)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) sl sa) \<and> (\<not> capCyclicZombie a sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' a (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. a)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a b sa cte x4. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); removeable' sl sa (capability.IRQHandlerCap x4); isFinal (capability.IRQHandlerCap x4) sl (cteCaps_of sa); ctes_of sa sl = Some cte; cteCap cte = capability.IRQHandlerCap x4; b = capability.IRQHandlerCap x4; cteCap rv = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> \<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some (capability.IRQHandlerCap x4)
 2. \<And>rv s'' rva s''a a b sa. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' a sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv); isZombie a \<and> b = capability.NullCap \<and> isFinal (cteCap rv) sl (cteCaps_of sa) \<and> capClass (cteCap rv) = capClass a \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv) \<and> capBits a = capBits (cteCap rv) \<and> capRange a = capRange (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))\<rbrakk> \<Longrightarrow> (capRemovable a sl \<longrightarrow> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa \<and> (b \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some b))) \<and> (\<not> capRemovable a sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie a sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. a)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) sl sa) \<and> (\<not> capCyclicZombie a sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' a (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. a)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a a b sa. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' a sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; a \<noteq> capability.NullCap \<longrightarrow> cte_refs' a = cte_refs' (cteCap rv); isZombie a \<and> b = capability.NullCap \<and> isFinal (cteCap rv) sl (cteCaps_of sa) \<and> capClass (cteCap rv) = capClass a \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv) \<and> capBits a = capBits (cteCap rv) \<and> capRange a = capRange (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)) \<and> (\<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))\<rbrakk> \<Longrightarrow> (capRemovable a sl \<longrightarrow> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa \<and> (b \<noteq> capability.NullCap \<longrightarrow> (\<forall>sl'. sl' \<noteq> sl \<longrightarrow> cteCaps_of sa sl' \<noteq> Some b))) \<and> (\<not> capRemovable a sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie a sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. a)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) sl sa) \<and> (\<not> capCyclicZombie a sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr a \<and> capBits (cteCap cte) = capBits a \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' a (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> (isZombie a \<or> isThreadCap a \<or> isCNodeCap a) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' a (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = a) \<circ> cteCap_update (\<lambda>y. a)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. a)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> (capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa) \<and> (\<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa
 2. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> (num = 0 \<longrightarrow> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa) \<and> (num = Suc 0 \<and> sl = global.capUntypedPtr (cteCap rv) \<longrightarrow> (exp \<or> q = global.capUntypedPtr (cteCap rv) \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' (global.capUntypedPtr (cteCap rv)) sa (cteCap cte)) (global.capUntypedPtr (cteCap rv)) sa)
 2. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> num = 0 \<longrightarrow> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' sl sa (cteCap cte)) sl sa
 2. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> num = Suc 0 \<and> sl = global.capUntypedPtr (cteCap rv) \<longrightarrow> (exp \<or> q = global.capUntypedPtr (cteCap rv) \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' (global.capUntypedPtr (cteCap rv)) sa (cteCap cte)) (global.capUntypedPtr (cteCap rv)) sa
 3. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a sa bits cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits 0) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits 0) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits 0) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))); ctes_of sa sl = Some cte; cteCap cte = cteCap rv\<rbrakk> \<Longrightarrow> (exp \<or> q = sl \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))))) \<and> removeable' sl sa (cteCap rv)
 2. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> num = Suc 0 \<and> sl = global.capUntypedPtr (cteCap rv) \<longrightarrow> (exp \<or> q = global.capUntypedPtr (cteCap rv) \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' (global.capUntypedPtr (cteCap rv)) sa (cteCap cte)) (global.capUntypedPtr (cteCap rv)) sa
 3. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a sa bits cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits 0) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits 0) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits 0) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))); ctes_of sa sl = Some cte; cteCap cte = cteCap rv\<rbrakk> \<Longrightarrow> removeable' sl sa (cteCap rv)
 2. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> num = Suc 0 \<and> sl = global.capUntypedPtr (cteCap rv) \<longrightarrow> (exp \<or> q = global.capUntypedPtr (cteCap rv) \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' (global.capUntypedPtr (cteCap rv)) sa (cteCap cte)) (global.capUntypedPtr (cteCap rv)) sa
 3. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> num = Suc 0 \<and> sl = global.capUntypedPtr (cteCap rv) \<longrightarrow> (exp \<or> q = global.capUntypedPtr (cteCap rv) \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa) \<and> cte_wp_at' (\<lambda>cte. removeable' (global.capUntypedPtr (cteCap rv)) sa (cteCap cte)) (global.capUntypedPtr (cteCap rv)) sa
 2. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a sa bits cte. \<lbrakk>(rv, s'') \<in> fst (getCTE (global.capUntypedPtr (cteCap rv)) s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (global.capUntypedPtr (cteCap rv)) sa; no_cte_prop Pr sa; q = global.capUntypedPtr (cteCap rv) \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits (Suc 0)) = cte_refs' (cteCap rv); isFinal (cteCap rv) (global.capUntypedPtr (cteCap rv)) (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits (Suc 0)) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))); ctes_of sa (global.capUntypedPtr (cteCap rv)) = Some cte; cteCap cte = cteCap rv; sl = global.capUntypedPtr (cteCap rv)\<rbrakk> \<Longrightarrow> (exp \<or> q = global.capUntypedPtr (cteCap rv) \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))))) \<and> removeable' (global.capUntypedPtr (cteCap rv)) sa (cteCap rv)
 2. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a sa bits cte. \<lbrakk>(rv, s'') \<in> fst (getCTE (global.capUntypedPtr (cteCap rv)) s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (global.capUntypedPtr (cteCap rv)) sa; no_cte_prop Pr sa; q = global.capUntypedPtr (cteCap rv) \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits (Suc 0)) = cte_refs' (cteCap rv); isFinal (cteCap rv) (global.capUntypedPtr (cteCap rv)) (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits (Suc 0)) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))); ctes_of sa (global.capUntypedPtr (cteCap rv)) = Some cte; cteCap cte = cteCap rv; sl = global.capUntypedPtr (cteCap rv)\<rbrakk> \<Longrightarrow> removeable' (global.capUntypedPtr (cteCap rv)) sa (cteCap rv)
 2. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a sa bits cte x71 x72 x73. \<lbrakk>(rv, s'') \<in> fst (getCTE x71 s); (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie x71 bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x71 sa; no_cte_prop Pr sa; q = x71 \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> (\<exists>v0 v1 v2. cteCap cte = capability.Zombie v0 v1 v2) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> ((\<exists>v0 v1 v2. cp = capability.Zombie v0 v1 v2) \<longrightarrow> capZombiePtr cp \<noteq> q)))); {x71} = (\<lambda>x. x71 + x * 2 ^ cteSizeBits) ` {0..<word_of_nat x73}; isFinal (capability.Zombie x71 x72 x73) x71 (cteCaps_of sa); zBits bits = zBits x72; capRange (capability.Zombie x71 bits (Suc 0)) = capRange (capability.Zombie x71 x72 x73); ctes_of sa x71 = Some cte; cteCap cte = capability.Zombie x71 x72 x73; sl = x71; cteCap rv = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (\<exists>p. p \<noteq> x71 \<and> cte_wp_at' (\<lambda>cte. capMasterCap (cteCap cte) = capability.Zombie x71 x72 x73) p sa) \<or> (\<forall>p\<in>{0..<word_of_nat x73}. p * 2 ^ cteSizeBits \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (x71 + p * 2 ^ cteSizeBits) sa)
 2. \<And>rv s'' rva s''a sa bits cte x111 x112 x113 x114. \<lbrakk>(rv, s'') \<in> fst (getCTE x111 s); (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie x111 bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x111 sa; no_cte_prop Pr sa; q = x111 \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> (\<exists>v0 v1 v2. cteCap cte = capability.Zombie v0 v1 v2) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> ((\<exists>v0 v1 v2. cp = capability.Zombie v0 v1 v2) \<longrightarrow> capZombiePtr cp \<noteq> q)))); {x111} = (\<lambda>x. x111 + x * 2 ^ cteSizeBits) ` {0..2 ^ x112 - 1}; isFinal (capability.CNodeCap x111 x112 x113 x114) x111 (cteCaps_of sa); zBits bits = objBits undefined + x112; capRange (capability.Zombie x111 bits (Suc 0)) = capRange (capability.CNodeCap x111 x112 x113 x114); ctes_of sa x111 = Some cte; cteCap cte = capability.CNodeCap x111 x112 x113 x114; sl = x111; cteCap rv = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>p. p \<noteq> x111 \<and> cte_wp_at' (\<lambda>cte. capMasterCap (cteCap cte) = capability.CNodeCap x111 x112 0 0) p sa) \<or> (\<forall>p\<in>{0..2 ^ x112 - 1}. p * 2 ^ cteSizeBits \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (x111 + p * 2 ^ cteSizeBits) sa)
 3. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a sa bits cte x71 x72 x73. \<lbrakk>(rv, s'') \<in> fst (getCTE x71 s); (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie x71 bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x71 sa; no_cte_prop Pr sa; q = x71 \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> (\<exists>v0 v1 v2. cteCap cte = capability.Zombie v0 v1 v2) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> ((\<exists>v0 v1 v2. cp = capability.Zombie v0 v1 v2) \<longrightarrow> capZombiePtr cp \<noteq> q)))); {x71} = (\<lambda>x. x71 + x * 2 ^ cteSizeBits) ` {0..<word_of_nat x73}; isFinal (capability.Zombie x71 x72 x73) x71 (cteCaps_of sa); zBits bits = zBits x72; capRange (capability.Zombie x71 bits (Suc 0)) = capRange (capability.Zombie x71 x72 x73); ctes_of sa x71 = Some cte; cteCap cte = capability.Zombie x71 x72 x73; sl = x71; cteCap rv = capability.Zombie x71 x72 x73; word_of_nat x73 = 1\<rbrakk> \<Longrightarrow> (\<exists>p. p \<noteq> x71 \<and> cte_wp_at' (\<lambda>cte. capMasterCap (cteCap cte) = capability.Zombie x71 x72 x73) p sa) \<or> (\<forall>p\<in>{0..<word_of_nat x73}. p * 2 ^ cteSizeBits \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (x71 + p * 2 ^ cteSizeBits) sa)
 2. \<And>rv s'' rva s''a sa bits cte x111 x112 x113 x114. \<lbrakk>(rv, s'') \<in> fst (getCTE x111 s); (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie x111 bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x111 sa; no_cte_prop Pr sa; q = x111 \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> (\<exists>v0 v1 v2. cteCap cte = capability.Zombie v0 v1 v2) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> ((\<exists>v0 v1 v2. cp = capability.Zombie v0 v1 v2) \<longrightarrow> capZombiePtr cp \<noteq> q)))); {x111} = (\<lambda>x. x111 + x * 2 ^ cteSizeBits) ` {0..2 ^ x112 - 1}; isFinal (capability.CNodeCap x111 x112 x113 x114) x111 (cteCaps_of sa); zBits bits = objBits undefined + x112; capRange (capability.Zombie x111 bits (Suc 0)) = capRange (capability.CNodeCap x111 x112 x113 x114); ctes_of sa x111 = Some cte; cteCap cte = capability.CNodeCap x111 x112 x113 x114; sl = x111; cteCap rv = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>p. p \<noteq> x111 \<and> cte_wp_at' (\<lambda>cte. capMasterCap (cteCap cte) = capability.CNodeCap x111 x112 0 0) p sa) \<or> (\<forall>p\<in>{0..2 ^ x112 - 1}. p * 2 ^ cteSizeBits \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (x111 + p * 2 ^ cteSizeBits) sa)
 3. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a sa bits cte x111 x112 x113 x114. \<lbrakk>(rv, s'') \<in> fst (getCTE x111 s); (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie x111 bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x111 sa; no_cte_prop Pr sa; q = x111 \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> (\<exists>v0 v1 v2. cteCap cte = capability.Zombie v0 v1 v2) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> ((\<exists>v0 v1 v2. cp = capability.Zombie v0 v1 v2) \<longrightarrow> capZombiePtr cp \<noteq> q)))); {x111} = (\<lambda>x. x111 + x * 2 ^ cteSizeBits) ` {0..2 ^ x112 - 1}; isFinal (capability.CNodeCap x111 x112 x113 x114) x111 (cteCaps_of sa); zBits bits = objBits undefined + x112; capRange (capability.Zombie x111 bits (Suc 0)) = capRange (capability.CNodeCap x111 x112 x113 x114); ctes_of sa x111 = Some cte; cteCap cte = capability.CNodeCap x111 x112 x113 x114; sl = x111; cteCap rv = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>p. p \<noteq> x111 \<and> cte_wp_at' (\<lambda>cte. capMasterCap (cteCap cte) = capability.CNodeCap x111 x112 0 0) p sa) \<or> (\<forall>p\<in>{0..2 ^ x112 - 1}. p * 2 ^ cteSizeBits \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (x111 + p * 2 ^ cteSizeBits) sa)
 2. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a sa bits cte x111 x112 x113 x114. \<lbrakk>isFinal (capability.CNodeCap x111 x112 x113 x114) x111 (cteCaps_of sa); zBits bits = objBits undefined + x112; capRange (capability.Zombie x111 bits (Suc 0)) = capRange (capability.CNodeCap x111 x112 x113 x114); ctes_of sa x111 = Some cte; cteCap cte = capability.CNodeCap x111 x112 x113 x114; sl = x111; cteCap rv = capability.CNodeCap x111 x112 x113 x114; (rv, s'') \<in> fst (getCTE x111 s); (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie x111 bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x111 sa; no_cte_prop Pr sa; q = x111 \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> (\<exists>v0 v1 v2. cteCap cte = capability.Zombie v0 v1 v2) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> ((\<exists>v0 v1 v2. cp = capability.Zombie v0 v1 v2) \<longrightarrow> capZombiePtr cp \<noteq> q))))\<rbrakk> \<Longrightarrow> 2 ^ x112 \<noteq> 0
 2. \<And>rv s'' rva s''a sa bits cte x111 x112 x113 x114. \<lbrakk>(rv, s'') \<in> fst (getCTE x111 s); (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie x111 bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x111 sa; no_cte_prop Pr sa; q = x111 \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> (\<exists>v0 v1 v2. cteCap cte = capability.Zombie v0 v1 v2) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> ((\<exists>v0 v1 v2. cp = capability.Zombie v0 v1 v2) \<longrightarrow> capZombiePtr cp \<noteq> q)))); {x111} = (\<lambda>x. x111 + x * 2 ^ cteSizeBits) ` {0..<2 ^ x112}; isFinal (capability.CNodeCap x111 x112 x113 x114) x111 (cteCaps_of sa); zBits bits = objBits undefined + x112; capRange (capability.Zombie x111 bits (Suc 0)) = capRange (capability.CNodeCap x111 x112 x113 x114); ctes_of sa x111 = Some cte; cteCap cte = capability.CNodeCap x111 x112 x113 x114; sl = x111; cteCap rv = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>p. p \<noteq> x111 \<and> cte_wp_at' (\<lambda>cte. capMasterCap (cteCap cte) = capability.CNodeCap x111 x112 0 0) p sa) \<or> (\<forall>p\<in>{0..2 ^ x112 - 1}. p * 2 ^ cteSizeBits \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (x111 + p * 2 ^ cteSizeBits) sa)
 3. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a sa bits cte x111 x112 x113 x114. \<lbrakk>isFinal (capability.CNodeCap x111 x112 x113 x114) x111 (cteCaps_of sa); zBits bits = objBits undefined + x112; capRange (capability.Zombie x111 bits (Suc 0)) = capRange (capability.CNodeCap x111 x112 x113 x114); cteCap cte = capability.CNodeCap x111 x112 x113 x114; sl = x111; cteCap rv = capability.CNodeCap x111 x112 x113 x114; (rv, s'') \<in> fst (getCTE x111 s); (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie x111 bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x111 sa; no_cte_prop Pr sa; q = x111 \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> (\<exists>v0 v1 v2. cteCap cte = capability.Zombie v0 v1 v2) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> ((\<exists>v0 v1 v2. cp = capability.Zombie v0 v1 v2) \<longrightarrow> capZombiePtr cp \<noteq> q))))\<rbrakk> \<Longrightarrow> valid_objs' sa
 2. \<And>rv s'' rva s''a sa bits cte x111 x112 x113 x114. \<lbrakk>isFinal (capability.CNodeCap x111 x112 x113 x114) x111 (cteCaps_of sa); zBits bits = objBits undefined + x112; capRange (capability.Zombie x111 bits (Suc 0)) = capRange (capability.CNodeCap x111 x112 x113 x114); cteCap cte = capability.CNodeCap x111 x112 x113 x114; sl = x111; cteCap rv = capability.CNodeCap x111 x112 x113 x114; (rv, s'') \<in> fst (getCTE x111 s); (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie x111 bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x111 sa; no_cte_prop Pr sa; q = x111 \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> (\<exists>v0 v1 v2. cteCap cte = capability.Zombie v0 v1 v2) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> ((\<exists>v0 v1 v2. cp = capability.Zombie v0 v1 v2) \<longrightarrow> capZombiePtr cp \<noteq> q)))); capAligned (cteCap cte)\<rbrakk> \<Longrightarrow> 2 ^ x112 \<noteq> 0
 3. \<And>rv s'' rva s''a sa bits cte x111 x112 x113 x114. \<lbrakk>(rv, s'') \<in> fst (getCTE x111 s); (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie x111 bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x111 sa; no_cte_prop Pr sa; q = x111 \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> (\<exists>v0 v1 v2. cteCap cte = capability.Zombie v0 v1 v2) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> ((\<exists>v0 v1 v2. cp = capability.Zombie v0 v1 v2) \<longrightarrow> capZombiePtr cp \<noteq> q)))); {x111} = (\<lambda>x. x111 + x * 2 ^ cteSizeBits) ` {0..<2 ^ x112}; isFinal (capability.CNodeCap x111 x112 x113 x114) x111 (cteCaps_of sa); zBits bits = objBits undefined + x112; capRange (capability.Zombie x111 bits (Suc 0)) = capRange (capability.CNodeCap x111 x112 x113 x114); ctes_of sa x111 = Some cte; cteCap cte = capability.CNodeCap x111 x112 x113 x114; sl = x111; cteCap rv = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>p. p \<noteq> x111 \<and> cte_wp_at' (\<lambda>cte. capMasterCap (cteCap cte) = capability.CNodeCap x111 x112 0 0) p sa) \<or> (\<forall>p\<in>{0..2 ^ x112 - 1}. p * 2 ^ cteSizeBits \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (x111 + p * 2 ^ cteSizeBits) sa)
 4. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 7. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a sa bits cte x111 x112 x113 x114. \<lbrakk>isFinal (capability.CNodeCap x111 x112 x113 x114) x111 (cteCaps_of sa); zBits bits = objBits undefined + x112; capRange (capability.Zombie x111 bits (Suc 0)) = capRange (capability.CNodeCap x111 x112 x113 x114); cteCap cte = capability.CNodeCap x111 x112 x113 x114; sl = x111; cteCap rv = capability.CNodeCap x111 x112 x113 x114; (rv, s'') \<in> fst (getCTE x111 s); (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie x111 bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x111 sa; no_cte_prop Pr sa; q = x111 \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> (\<exists>v0 v1 v2. cteCap cte = capability.Zombie v0 v1 v2) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> ((\<exists>v0 v1 v2. cp = capability.Zombie v0 v1 v2) \<longrightarrow> capZombiePtr cp \<noteq> q)))); capAligned (cteCap cte)\<rbrakk> \<Longrightarrow> 2 ^ x112 \<noteq> 0
 2. \<And>rv s'' rva s''a sa bits cte x111 x112 x113 x114. \<lbrakk>(rv, s'') \<in> fst (getCTE x111 s); (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie x111 bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x111 sa; no_cte_prop Pr sa; q = x111 \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> (\<exists>v0 v1 v2. cteCap cte = capability.Zombie v0 v1 v2) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> ((\<exists>v0 v1 v2. cp = capability.Zombie v0 v1 v2) \<longrightarrow> capZombiePtr cp \<noteq> q)))); {x111} = (\<lambda>x. x111 + x * 2 ^ cteSizeBits) ` {0..<2 ^ x112}; isFinal (capability.CNodeCap x111 x112 x113 x114) x111 (cteCaps_of sa); zBits bits = objBits undefined + x112; capRange (capability.Zombie x111 bits (Suc 0)) = capRange (capability.CNodeCap x111 x112 x113 x114); ctes_of sa x111 = Some cte; cteCap cte = capability.CNodeCap x111 x112 x113 x114; sl = x111; cteCap rv = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>p. p \<noteq> x111 \<and> cte_wp_at' (\<lambda>cte. capMasterCap (cteCap cte) = capability.CNodeCap x111 x112 0 0) p sa) \<or> (\<forall>p\<in>{0..2 ^ x112 - 1}. p * 2 ^ cteSizeBits \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (x111 + p * 2 ^ cteSizeBits) sa)
 3. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a sa bits cte x111 x112 x113 x114. \<lbrakk>(rv, s'') \<in> fst (getCTE x111 s); (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie x111 bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x111 sa; no_cte_prop Pr sa; q = x111 \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> (\<exists>v0 v1 v2. cteCap cte = capability.Zombie v0 v1 v2) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> ((\<exists>v0 v1 v2. cp = capability.Zombie v0 v1 v2) \<longrightarrow> capZombiePtr cp \<noteq> q)))); {x111} = (\<lambda>x. x111 + x * 2 ^ cteSizeBits) ` {0..<2 ^ x112}; isFinal (capability.CNodeCap x111 x112 x113 x114) x111 (cteCaps_of sa); zBits bits = objBits undefined + x112; capRange (capability.Zombie x111 bits (Suc 0)) = capRange (capability.CNodeCap x111 x112 x113 x114); ctes_of sa x111 = Some cte; cteCap cte = capability.CNodeCap x111 x112 x113 x114; sl = x111; cteCap rv = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>p. p \<noteq> x111 \<and> cte_wp_at' (\<lambda>cte. capMasterCap (cteCap cte) = capability.CNodeCap x111 x112 0 0) p sa) \<or> (\<forall>p\<in>{0..2 ^ x112 - 1}. p * 2 ^ cteSizeBits \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (x111 + p * 2 ^ cteSizeBits) sa)
 2. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a sa bits cte x111 x112 x113 x114. \<lbrakk>(rv, s'') \<in> fst (getCTE x111 s); (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie x111 bits (Suc 0)) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) x111 sa; no_cte_prop Pr sa; q = x111 \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> (\<exists>v0 v1 v2. cteCap cte = capability.Zombie v0 v1 v2) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> ((\<exists>v0 v1 v2. cp = capability.Zombie v0 v1 v2) \<longrightarrow> capZombiePtr cp \<noteq> q)))); {x111} = (\<lambda>x. x111 + x * 2 ^ cteSizeBits) ` {0..<2 ^ x112}; isFinal (capability.CNodeCap x111 x112 x113 x114) x111 (cteCaps_of sa); zBits bits = objBits undefined + x112; capRange (capability.Zombie x111 bits (Suc 0)) = capRange (capability.CNodeCap x111 x112 x113 x114); ctes_of sa x111 = Some cte; cteCap cte = capability.CNodeCap x111 x112 x113 x114; sl = x111; cteCap rv = capability.CNodeCap x111 x112 x113 x114; 2 ^ x112 = 1\<rbrakk> \<Longrightarrow> (\<exists>p. p \<noteq> x111 \<and> cte_wp_at' (\<lambda>cte. capMasterCap (cteCap cte) = capability.CNodeCap x111 x112 0 0) p sa) \<or> (\<forall>p\<in>{0..2 ^ x112 - 1}. p * 2 ^ cteSizeBits \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (x111 + p * 2 ^ cteSizeBits) sa)
 2. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a sa bits num. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl sa; q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa; cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b)))\<rbrakk> \<Longrightarrow> \<not> capRemovable (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa))) \<and> (exp \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of sa)) sl sa \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (cteCap rv) \<and> capBits (cteCap cte) = capBits (cteCap rv) \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' sa) - cte_refs' (cteCap rv) (irq_node' sa). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r sa) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))))) sl sa \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa \<and> cte_wp_at' (\<lambda>cte. sl \<in> cte_refs' (cteCap cte) (irq_node' sa) \<longrightarrow> sl \<in> cte_refs' (cteCap rv) (irq_node' sa)) sl sa) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) sl sa \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> cte_wp_at' ((\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<circ> cteCap_update (\<lambda>y. capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num)) q sa) \<and> (sl \<noteq> q \<longrightarrow> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q sa)))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a sa bits num cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))); ctes_of sa sl = Some cte; cteCap cte = cteCap rv; 0 < num; num = Suc 0 \<longrightarrow> sl \<noteq> global.capUntypedPtr (cteCap rv)\<rbrakk> \<Longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> final_matters' (cteCap rv) \<and> \<not> isUntypedCap (cteCap rv) \<and> (q = sl \<or> (sl = q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte) \<and> (Q (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<or> global.capUntypedPtr (cteCap rv) = q \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))) \<and> (sl \<noteq> q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))))))) \<and> (exp \<longrightarrow> final_matters' (cteCap rv) \<and> \<not> isUntypedCap (cteCap rv)) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> final_matters' (cteCap rv) \<and> \<not> isUntypedCap (cteCap rv) \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte) \<and> (Q (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<or> global.capUntypedPtr (cteCap rv) = q \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))) \<and> (sl \<noteq> q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))))))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a sa bits num cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))); ctes_of sa sl = Some cte; cteCap cte = cteCap rv; 0 < num; num = Suc 0 \<longrightarrow> sl \<noteq> global.capUntypedPtr (cteCap rv); final_matters' (cteCap rv) \<and> \<not> isUntypedCap (cteCap rv)\<rbrakk> \<Longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> final_matters' (cteCap rv) \<and> \<not> isUntypedCap (cteCap rv) \<and> (q = sl \<or> (sl = q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte) \<and> (Q (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<or> global.capUntypedPtr (cteCap rv) = q \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))) \<and> (sl \<noteq> q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))))))) \<and> (exp \<longrightarrow> final_matters' (cteCap rv) \<and> \<not> isUntypedCap (cteCap rv)) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> final_matters' (cteCap rv) \<and> \<not> isUntypedCap (cteCap rv) \<and> (exp \<or> q = sl \<or> (sl = q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte) \<and> (Q (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<or> global.capUntypedPtr (cteCap rv) = q \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))) \<and> (sl \<noteq> q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))))))
 2. \<And>rv s'' rva s''a sa bits num cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))); ctes_of sa sl = Some cte; cteCap cte = cteCap rv; 0 < num; num = Suc 0 \<longrightarrow> sl \<noteq> global.capUntypedPtr (cteCap rv)\<rbrakk> \<Longrightarrow> final_matters' (cteCap rv) \<and> \<not> isUntypedCap (cteCap rv)
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a sa bits num cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))); ctes_of sa sl = Some cte; cteCap cte = cteCap rv; 0 < num; num = Suc 0 \<longrightarrow> sl \<noteq> global.capUntypedPtr (cteCap rv); final_matters' (cteCap rv); \<not> isUntypedCap (cteCap rv)\<rbrakk> \<Longrightarrow> (\<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> q = sl \<or> (sl = q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte) \<and> (Q (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<or> global.capUntypedPtr (cteCap rv) = q \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))) \<and> (sl \<noteq> q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))))) \<and> (\<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> exp \<or> q = sl \<or> (sl = q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte) \<and> (Q (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<or> global.capUntypedPtr (cteCap rv) = q \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))) \<and> (sl \<noteq> q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))))))
 2. \<And>rv s'' rva s''a sa bits num cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))); ctes_of sa sl = Some cte; cteCap cte = cteCap rv; 0 < num; num = Suc 0 \<longrightarrow> sl \<noteq> global.capUntypedPtr (cteCap rv)\<rbrakk> \<Longrightarrow> final_matters' (cteCap rv) \<and> \<not> isUntypedCap (cteCap rv)
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a sa bits num cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))); ctes_of sa sl = Some cte; cteCap cte = cteCap rv; 0 < num; num = Suc 0 \<longrightarrow> sl \<noteq> global.capUntypedPtr (cteCap rv); final_matters' (cteCap rv); \<not> isUntypedCap (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> exp \<and> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> q = sl \<or> (sl = q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte) \<and> (Q (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<or> global.capUntypedPtr (cteCap rv) = q \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))) \<and> (sl \<noteq> q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))))
 2. \<And>rv s'' rva s''a sa bits num cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))); ctes_of sa sl = Some cte; cteCap cte = cteCap rv; 0 < num; num = Suc 0 \<longrightarrow> sl \<noteq> global.capUntypedPtr (cteCap rv); final_matters' (cteCap rv); \<not> isUntypedCap (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> exp \<or> q = sl \<or> (sl = q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte) \<and> (Q (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<or> global.capUntypedPtr (cteCap rv) = q \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))) \<and> (sl \<noteq> q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))))
 3. \<And>rv s'' rva s''a sa bits num cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))); ctes_of sa sl = Some cte; cteCap cte = cteCap rv; 0 < num; num = Suc 0 \<longrightarrow> sl \<noteq> global.capUntypedPtr (cteCap rv)\<rbrakk> \<Longrightarrow> final_matters' (cteCap rv) \<and> \<not> isUntypedCap (cteCap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 6. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a sa bits num cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))); ctes_of sa sl = Some cte; cteCap cte = cteCap rv; 0 < num; num = Suc 0 \<longrightarrow> sl \<noteq> global.capUntypedPtr (cteCap rv); final_matters' (cteCap rv); \<not> isUntypedCap (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> capCyclicZombie (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sl \<longrightarrow> exp \<or> q = sl \<or> (sl = q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte) \<and> (Q (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) \<or> global.capUntypedPtr (cteCap rv) = q \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))) \<and> (sl \<noteq> q \<longrightarrow> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))))
 2. \<And>rv s'' rva s''a sa bits num cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))); ctes_of sa sl = Some cte; cteCap cte = cteCap rv; 0 < num; num = Suc 0 \<longrightarrow> sl \<noteq> global.capUntypedPtr (cteCap rv)\<rbrakk> \<Longrightarrow> final_matters' (cteCap rv) \<and> \<not> isUntypedCap (cteCap rv)
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 5. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a sa bits num cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl s); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); invs' sa; sch_act_simple sa; valid_cap' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) sa; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl sa; no_cte_prop Pr sa; q = sl \<or> exp \<or> (\<exists>cte. ctes_of sa q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); cte_refs' (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = cte_refs' (cteCap rv); isFinal (cteCap rv) sl (cteCaps_of sa); capClass (cteCap rv) = PhysicalClass; zBits bits = capBits (cteCap rv); capRange (capability.Zombie (global.capUntypedPtr (cteCap rv)) bits num) = capRange (cteCap rv); isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv); \<forall>p\<in>threadCapRefs (cteCap rv). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p sa \<and> obj_at' (Not \<circ> tcbQueued) p sa \<and> bound_tcb_at' ((=) None) p sa \<and> (\<forall>a b. p \<notin> set (ksReadyQueues sa (a, b))); ctes_of sa sl = Some cte; cteCap cte = cteCap rv; 0 < num; num = Suc 0 \<longrightarrow> sl \<noteq> global.capUntypedPtr (cteCap rv)\<rbrakk> \<Longrightarrow> final_matters' (cteCap rv) \<and> \<not> isUntypedCap (cteCap rv)
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 4. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (3 subgoals):
 1. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) s); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. ((invs' and sch_act_simple and valid_cap' (cteCap rv) and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl) s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (no_cte_prop Pr and invs' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl478 rv s'' rva)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. ((\<lambda>a. (Q and isZombie) a \<or> (\<exists>zb n cp. a = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) and isZombie) (cteCap cte)) q s)) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> rva = isFinal (cteCap rv) sl (cteCaps_of s)) \<and> weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 2. s \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst (True, capability.NullCap) \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd (True, capability.NullCap) \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd (True, capability.NullCap)))) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>
 3. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P'\<rbrace> getCTE sl \<lbrace>\<lambda>rv s. (cteCap rv = capability.NullCap \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (cteCap rv \<noteq> capability.NullCap \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> sch_act_simple s \<and> valid_cap' (cteCap rv) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) (?sl1057 rv) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<and> isZombie (cteCap cte)) q s) \<and> valid_cap' (cteCap rv) s \<and> invs' s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> (final_matters' (cteCap rv) \<longrightarrow> valid_mdb' s \<and> cte_wp_at' ((=) rv) sl s) \<and> weak_sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 2. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> ?P' s proof (prove)
goal (1 subgoal):
 1. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<Longrightarrow> \<forall>cte. cte_wp_at' ((=) cte) sl s \<longrightarrow> (cteCap cte = capability.NullCap \<longrightarrow> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> invs' s \<and> sch_act_simple s \<and> valid_cap' (cteCap cte) s \<and> cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) sl s \<and> sch_act_simple s \<and> valid_cap' (cteCap cte) s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) (?sl1057 cte) s \<and> cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) sl s \<and> (q = sl \<or> exp \<or> cte_wp_at' (\<lambda>cte. (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<and> isZombie (cteCap cte)) q s) \<and> valid_cap' (cteCap cte) s \<and> invs' s \<and> cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) sl s \<and> (final_matters' (cteCap cte) \<longrightarrow> valid_mdb' s \<and> cte_wp_at' ((=) cte) sl s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>no_cte_prop Pr s; invs' s; sch_act_simple s; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s; exp \<or> q = sl \<or> (\<exists>cte. ctes_of s q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); ctes_of s sl = Some cte\<rbrakk> \<Longrightarrow> (cteCap cte = capability.NullCap \<longrightarrow> removeable' sl s capability.NullCap) \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> valid_cap' (cteCap cte) s \<and> (\<exists>ctea. ctes_of s (?sl1057 cte) = Some ctea \<and> cteCap ctea = cteCap cte) \<and> (q = sl \<or> exp \<or> (\<exists>cte. ctes_of s q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<and> isZombie (cteCap cte))) \<and> valid_cap' (cteCap cte) s \<and> (final_matters' (cteCap cte) \<longrightarrow> valid_mdb' s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>no_cte_prop Pr s; invs' s; sch_act_simple s; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s; exp \<or> q = sl \<or> (\<exists>cte. ctes_of s q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); ctes_of s sl = Some cte\<rbrakk> \<Longrightarrow> cteCap cte \<noteq> capability.NullCap \<longrightarrow> valid_cap' (cteCap cte) s \<and> (\<exists>ctea. ctes_of s (?sl1057 cte) = Some ctea \<and> cteCap ctea = cteCap cte) \<and> (q = sl \<or> exp \<or> (\<exists>cte. ctes_of s q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) \<and> isZombie (cteCap cte))) \<and> valid_cap' (cteCap cte) s \<and> (final_matters' (cteCap cte) \<longrightarrow> valid_mdb' s) \<and> weak_sch_act_wf (ksSchedulerAction s) s proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>no_cte_prop Pr s; invs' s; sch_act_simple s; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s; exp \<or> q = sl \<or> (\<exists>cte. ctes_of s q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); ctes_of s sl = Some cte; cteCap cte \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> valid_cap' (cteCap cte) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> (final_matters' (cteCap cte) \<longrightarrow> valid_mdb' s) \<and> (\<exists>ctea. cteCap ctea = cteCap cte \<and> ctes_of s (?sl1057 cte) = Some ctea) \<and> (q = sl \<or> exp \<or> (\<exists>cte. isZombie (cteCap cte) \<and> ctes_of s q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))))) proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>no_cte_prop Pr s; invs' s; sch_act_simple s; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s; exp \<or> q = sl \<or> (\<exists>cte. ctes_of s q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); ctes_of s sl = Some cte; cteCap cte \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> weak_sch_act_wf (ksSchedulerAction s) s \<and> (final_matters' (cteCap cte) \<longrightarrow> valid_mdb' s) \<and> (\<exists>ctea. cteCap ctea = cteCap cte \<and> ctes_of s (?sl1057 cte) = Some ctea) \<and> (q = sl \<or> exp \<or> (\<exists>cte. isZombie (cteCap cte) \<and> ctes_of s q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))))) proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>no_cte_prop Pr s; invs' s; sch_act_simple s; exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s; exp \<or> q = sl \<or> (\<exists>cte. ctes_of s q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q)))); ctes_of s sl = Some cte; cteCap cte \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> (final_matters' (cteCap cte) \<longrightarrow> valid_mdb' s) \<and> (\<exists>ctea. cteCap ctea = cteCap cte \<and> ctes_of s (?sl1057 cte) = Some ctea) \<and> (q = sl \<or> exp \<or> (\<exists>cte. isZombie (cteCap cte) \<and> ctes_of s q = Some cte \<and> (Q (cteCap cte) \<and> isZombie (cteCap cte) \<or> (\<exists>zb n. cteCap cte = capability.Zombie q zb n) \<and> (\<exists>cp. Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))))) proof (prove)
goal:
No subgoals! proof (state)
this:
s \<turnstile> \<lbrace>\<lambda>s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s)\<rbrace> finaliseSlot' sl exp \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s \<and> (exp \<or> q = sl \<or> cte_wp_at' (\<lambda>cte. (Q and isZombie) (cteCap cte) \<or> (\<exists>zb n cp. cteCap cte = capability.Zombie q zb n \<and> Q cp \<and> (isZombie cp \<longrightarrow> capZombiePtr cp \<noteq> q))) q s) \<and> (fst rv \<longrightarrow> cte_wp_at' (\<lambda>cte. removeable' sl s (cteCap cte)) sl s) \<and> (\<forall>sl'. snd rv \<noteq> capability.NullCap \<longrightarrow> sl' \<noteq> sl \<longrightarrow> cteCaps_of s sl' \<noteq> Some (snd rv))\<rbrace>, \<lbrace>\<lambda>rv s. no_cte_prop Pr s \<and> invs' s \<and> sch_act_simple s\<rbrace>

goal:
No subgoals!