theory Delete_C

lemma cteRevoke_ccorres1:
  "ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
     (invs' and sch_act_simple) (UNIV \<inter> {s. slot_' s = cte_Ptr slot}) []
     (cutMon ((=) s) (cteRevoke slot)) (Call cteRevoke_'proc)" apply (cinit' lift: slot_' simp: whileAnno_def) apply simp apply (rule ccorres_inst[where P="invs' and sch_act_simple" and P'=UNIV]) prefer 2 apply simp apply (induct rule: cteRevoke.induct[where ?a0.0=slot and ?a1.0=s]) subgoal premises hyps for slot' s' apply (rule ccorres_guard_imp2) apply (subst cteRevoke.simps[abs_def]) apply (simp add: liftE_bindE cutMon_walk_bind
                 del: Collect_const) apply (rule ccorres_drop_cutMon_bind) apply (rule ccorres_symb_exec_l'
                       [OF _ getCTE_inv _ empty_fail_getCTE]) apply (rule ccorres_move_c_guard_cte) apply (rule_tac xf'=ret__unsigned_' and val="mdbNext (cteMDBNode rv)"
                    and R="cte_wp_at' ((=) rv) slot'"
                     in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply vcg apply (clarsimp simp: cte_wp_at_ctes_of) apply (erule(1) cmap_relationE1 [OF cmap_relation_cte]) apply (simp add: typ_heap_simps) apply (clarsimp simp: ccte_relation_def map_option_Some_eq2) apply ceqv apply (rule ccorres_rhs_assoc2)+ apply (rule iffD1 [OF ccorres_expand_while_iff_Seq2]) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (simp only: if_1_0_0 simp_thms unlessE_def) apply (rule ccorres_Cond_rhs_Seq[rotated]) apply simp apply (rule ccorres_cond_false) apply (rule ccorres_drop_cutMon) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: returnOk_def return_def) apply (rule ccorres_cutMon, simp only: cutMon_walk_if cutMon_walk_bind) apply (rule ccorres_if_lhs) apply (rule ccorres_False[where P'=UNIV]) apply (rule ccorres_drop_cutMon_bind) apply (rule ccorres_pre_getCTE) apply (rule ccorres_rhs_assoc)+ apply (rule_tac xf'="ret__unsigned_long_'"
                      and val="from_bool (isMDBParentOf rv rva)"
                      and R="cte_wp_at' ((=) rv) slot' and invs'
                               and cte_wp_at' ((=) rva) (mdbNext (cteMDBNode rv))"
                       in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply vcg apply (clarsimp simp: cte_wp_at_ctes_of) apply (frule_tac p="slot'" in ctes_of_valid', clarsimp) apply (frule_tac p="mdbNext m" for m in ctes_of_valid', clarsimp) apply (drule(1) rf_sr_ctes_of_clift[rotated])+ apply (clarsimp simp: ccte_relation_def) apply (auto intro: valid_capAligned)[1] apply ceqv apply csymbr apply (rule ccorres_cutMon) apply (simp add: whenE_def cutMon_walk_if cutMon_walk_bindE
                         from_bool_0 if_1_0_0
                    del: Collect_const cong: if_cong call_ignore_cong) apply (rule ccorres_if_lhs) apply (rule ccorres_cond_true) apply (rule ccorres_drop_cutMon_bindE) apply (rule ccorres_rhs_assoc)+ apply (ctac(no_vcg) add: cteDelete_ccorres) apply (simp del: Collect_const add: Collect_False ccorres_cond_iffs) apply (rule ccorres_cutMon, simp only: cutMon_walk_bindE) apply (rule ccorres_drop_cutMon_bindE) apply (ctac(no_vcg) add: preemptionPoint_ccorres) apply (simp del: Collect_const add: Collect_False ccorres_cond_iffs) apply (rule ccorres_cutMon) apply (rule rsubst[where P="ccorres r xf' P P' hs a" for r xf' P P' hs a]) apply (rule hyps; fastforce simp: in_monad) apply simp apply (simp, rule ccorres_split_throws) apply (rule ccorres_return_C_errorE; simp) apply vcg apply (wp preemptionPoint_invR) apply simp apply simp apply (simp, rule ccorres_split_throws) apply (rule ccorres_return_C_errorE; simp) apply vcg apply (wp cteDelete_invs' cteDelete_sch_act_simple) apply (rule ccorres_cond_false) apply (rule ccorres_drop_cutMon) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: returnOk_def return_def) apply (simp add: guard_is_UNIV_def cintr_def Collect_const_mem exception_defs) apply (simp add: guard_is_UNIV_def) apply (rule getCTE_wp) apply (clarsimp simp: cte_wp_at_ctes_of nullPointer_def) apply (drule invs_mdb') apply (clarsimp simp: valid_mdb'_def valid_mdb_ctes_def valid_nullcaps_def) apply (case_tac cte, clarsimp) apply (fastforce simp: nullMDBNode_def) done done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and sch_act_simple) (UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace>) [] (cutMon ((=) s) (cteRevoke slot)) (Call cteRevoke_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>slota. slota = cte_Ptr slot \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q426 slota) (?Q'426 slota) [SKIP] (cutMon ((=) s) (cteRevoke slot)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(slota,\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(slota,\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>slota s s'. \<lbrakk>slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q426 slota s \<and> s' \<in> ?Q'426 slota proof (prove)
goal (2 subgoals):
 1. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q426 (cte_Ptr slot)) (?Q'426 (cte_Ptr slot)) [SKIP] (cutMon ((=) s) (cteRevoke slot)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot,\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot,\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>slota s s'. \<lbrakk>slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q426 slota s \<and> s' \<in> ?Q'426 slota proof (prove)
goal (2 subgoals):
 1. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and sch_act_simple) UNIV [SKIP] (cutMon ((=) s) (cteRevoke slot)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot,\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot,\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>slota s s'. \<lbrakk>slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple) s \<and> s' \<in> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>slota s s'. \<lbrakk>slota = cte_Ptr slot; (s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple) s \<and> s' \<in> UNIV
 2. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and sch_act_simple) UNIV [SKIP] (cutMon ((=) s) (cteRevoke slot)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot,\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot,\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and sch_act_simple) UNIV [SKIP] (cutMon ((=) s) (cteRevoke slot)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot,\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot,\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) proof (prove)
goal (1 subgoal):
 1. \<And>p s. (\<And>rv st rva sta rvb stb rvc stc rvd std. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE p) s); (Inr rva, sta) \<in> fst (returnOk (mdbNext $ cteMDBNode rv) st); \<not> ((isNullCap $ cteCap rv) \<or> rva = nullPointer); (Inr rvb, stb) \<in> fst ((withoutPreemption $ getCTE rva) sta); rv `~isMDBParentOf~` rvb; (Inr rvc, stc) \<in> fst (cteDelete rva True stb); (Inr rvd, std) \<in> fst (preemptionPoint stc)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and sch_act_simple) UNIV [SKIP] (cutMon ((=) std) (cteRevoke p)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr p} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr p\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr p,\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr p} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr p\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr p,\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and sch_act_simple) UNIV [SKIP] (cutMon ((=) s) (cteRevoke p)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr p} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr p\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr p,\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr p} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr p\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr p,\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and sch_act_simple) UNIV [SKIP] (cutMon ((=) s') (cteRevoke slot')) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) proof (prove)
goal (2 subgoals):
 1. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?Q ?Q' [SKIP] (cutMon ((=) s') (cteRevoke slot')) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> ?Q' proof (prove)
goal (2 subgoals):
 1. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?Q ?Q' [SKIP] (cutMon ((=) s') (doE cte <- withoutPreemption $ getCTE slot';
nextPtr <- returnOk (mdbNext $ cteMDBNode cte);
unlessE ((isNullCap $ cteCap cte) \<or> nextPtr = nullPointer) $ doE nextCTE <- withoutPreemption $ getCTE nextPtr;
whenE (cte `~isMDBParentOf~` nextCTE) $ doE cteDelete nextPtr True;
preemptionPoint;
cteRevoke slot'
odE
odE
odE)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> ?Q' proof (prove)
goal (2 subgoals):
 1. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?Q ?Q' [SKIP] (do rv <- cutMon ((=) s') (getCTE slot');
cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> ?Q' proof (prove)
goal (2 subgoals):
 1. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') ?Q ?Q' [SKIP] (do rv <- getCTE slot';
cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> ?Q' proof (prove)
goal (3 subgoals):
 1. \<And>rv. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9 rv) ?Q' [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>?Q9\<rbrace>
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> ?Q' proof (prove)
goal (3 subgoals):
 1. \<And>rv. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A16 rv) ?C'17 [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C''])));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. ?A16 rv and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> ?C'17 \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s. \<Gamma>\<turnstile> (UNIV \<inter> {s'. cte_wp_at' ((=) rv) slot' s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = mdbNext (cteMDBNode rv)\<rbrace>)
 2. \<And>rv rv' t t'. ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?y'19 rv rv')
 3. \<And>rv. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P19 rv) (?Q19 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))) (?y'19 rv (mdbNext (cteMDBNode rv)))
 4. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. ?Q19 rv)
 5. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. ?P19 rv and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s. UNIV \<inter> {s'. cte_wp_at' ((=) rv) slot' s \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>ret__unsigned. ret__unsigned = mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C''])))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))))\<rparr>) \<in> rf_sr \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C''])))) = mdbNext (cteMDBNode rv)}
 2. \<And>rv rv' t t'. ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?y'19 rv rv')
 3. \<And>rv. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P19 rv) (?Q19 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))) (?y'19 rv (mdbNext (cteMDBNode rv)))
 4. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. ?Q19 rv)
 5. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. ?P19 rv and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s x. \<lbrakk>ctes_of s slot' = Some rv; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C''])))) = mdbNext (cteMDBNode rv)
 2. \<And>rv rv' t t'. ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?y'19 rv rv')
 3. \<And>rv. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P19 rv) (?Q19 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))) (?y'19 rv (mdbNext (cteMDBNode rv)))
 4. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. ?Q19 rv)
 5. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. ?P19 rv and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s x y'. \<lbrakk>ctes_of s slot' = Some rv; ctes_of s slot' = Some rv; ccte_relation rv y'; cslift x (cte_Ptr slot') = Some y'\<rbrakk> \<Longrightarrow> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals x))) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C''])))) = mdbNext (cteMDBNode rv)
 2. \<And>rv rv' t t'. ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?y'19 rv rv')
 3. \<And>rv. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P19 rv) (?Q19 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))) (?y'19 rv (mdbNext (cteMDBNode rv)))
 4. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. ?Q19 rv)
 5. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. ?P19 rv and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s x y'. \<lbrakk>ctes_of s slot' = Some rv; ccte_relation rv y'; cslift x (cte_Ptr slot') = Some y'\<rbrakk> \<Longrightarrow> mdbNext_CL (mdb_node_lift (cteMDBNode_C y')) = mdbNext (cteMDBNode rv)
 2. \<And>rv rv' t t'. ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?y'19 rv rv')
 3. \<And>rv. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P19 rv) (?Q19 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))) (?y'19 rv (mdbNext (cteMDBNode rv)))
 4. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. ?Q19 rv)
 5. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. ?P19 rv and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' t t'. ceqv \<Gamma> ret__unsigned_' rv' t t' (\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?y'19 rv rv')
 2. \<And>rv. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P19 rv) (?Q19 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))) (?y'19 rv (mdbNext (cteMDBNode rv)))
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. ?Q19 rv)
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. ?P19 rv and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P19 rv) (?Q19 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))) (\<acute>nextPtr :== cte_Ptr (mdbNext (cteMDBNode rv));;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. ?Q19 rv)
 3. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. ?P19 rv and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P19 rv) (?Q19 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))) (\<acute>nextPtr :== cte_Ptr (mdbNext (cteMDBNode rv));;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. ?Q19 rv)
 3. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. ?P19 rv and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P19 rv) (?Q19 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))) (\<acute>nextPtr :== cte_Ptr (mdbNext (cteMDBNode rv));;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. ?Q19 rv)
 3. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. ?P19 rv and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P19 rv) (?Q19 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))) (\<acute>nextPtr :== cte_Ptr (mdbNext (cteMDBNode rv));;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)))
 2. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. ?Q19 rv)
 3. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. ?P19 rv and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P19 rv) (?G'345 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))) (\<acute>ret__int :== (if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI))
 2. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> ?G'345 rv})
 3. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. ?P19 rv and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P19 rv) (?G'686 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (unlessE (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) (do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od))) (IF (if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> ?G'686 rv}})
 3. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. ?P19 rv and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P19 rv) (?G'686 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (if cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer then returnOk () else do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od)) (IF cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> ?G'686 rv}})
 3. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. ?P19 rv and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv. \<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R807 rv) (?T807 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (if cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer then returnOk () else do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od)) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv. cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q807 rv) (?S807 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (if cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer then returnOk () else do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od)) (\<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> ?S807 rv) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> ?T807 rv)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> ?Q807 rv s) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> ?R807 rv s)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv. mdbNext (cteMDBNode rv) = 0 \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R807 rv) (?T807 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (returnOk ())) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(NULL,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv. cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q807 rv) (?S807 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (if cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer then returnOk () else do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od)) (\<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> ?S807 rv) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> ?T807 rv)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> ?Q807 rv s) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> ?R807 rv s)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv. mdbNext (cteMDBNode rv) = 0 \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R807 rv) (?R'819 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (returnOk ())) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv. cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q807 rv) (?S807 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (if cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer then returnOk () else do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od)) (\<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> ?S807 rv) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> ?R'819 rv \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> ?Q807 rv s) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> ?R807 rv s)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv. mdbNext (cteMDBNode rv) = 0 \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R807 rv) (?R'819 rv) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv. cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q807 rv) (?S807 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (if cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer then returnOk () else do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od)) (\<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> ?S807 rv) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> ?R'819 rv \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> ?Q807 rv s) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> ?R807 rv s)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv. mdbNext (cteMDBNode rv) = 0 \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (returnOk () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>rv. cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q807 rv) (?S807 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (if cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer then returnOk () else do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od)) (\<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> ?S807 rv) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> ?Q807 rv s) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv \<sigma>. mdbNext (cteMDBNode rv) = 0 \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (returnOk () \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>rv. cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q807 rv) (?S807 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (if cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer then returnOk () else do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od)) (\<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> ?S807 rv) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> ?Q807 rv s) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv. cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q807 rv) (?S807 rv) [SKIP] (cutMon (\<lambda>s'a. (rv, s'a) \<in> fst (getCTE slot' s')) (if cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer then returnOk () else do nextCTE <- getCTE (mdbNext (cteMDBNode rv));
whenE (isMDBParentOf rv nextCTE) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE)
od)) (\<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> ?S807 rv) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 3. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> ?Q807 rv s) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s')\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q807 rv) (?S807 rv) [SKIP] (if cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer then cutMon ((=) s) (returnOk ()) else do rva <- cutMon ((=) s) (getCTE (mdbNext (cteMDBNode rv)));
cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))
od) (\<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> ?S807 rv) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 3. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> ?Q807 rv s) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q838 rv) (?S842 rv) [SKIP] (cutMon ((=) s) (returnOk ())) (\<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv s. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R840 rv) (?T844 rv) [SKIP] (do rva <- cutMon ((=) s) (getCTE (mdbNext (cteMDBNode rv)));
cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))
od) (\<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> ?S842 rv) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> ?T844 rv)}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> ?Q838 rv s) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> ?R840 rv s)) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R840 rv) (?T844 rv) [SKIP] (do rva <- cutMon ((=) s) (getCTE (mdbNext (cteMDBNode rv)));
cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))
od) (\<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> ?T844 rv)}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 3. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> ?R840 rv s)) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R840 rv) (?T844 rv) [SKIP] (do rva <- getCTE (mdbNext (cteMDBNode rv));
cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))
od) (\<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> ?T844 rv)}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 3. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> ?R840 rv s)) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?P855 rv a rva) (?P'854 rv rva) [SKIP] (cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))) (\<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?P'854 rv (cte_to_H cte')})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 3. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ?P855 rv s cte))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?P855 rv a rva) (?P'854 rv rva) [SKIP] (cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))) (\<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv)));;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI))
 2. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?P'854 rv (cte_to_H cte')})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 3. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ?P855 rv s cte))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rva sa. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) rva) (mdbNext (cteMDBNode rv))) sa \<and> (sa, s') \<in> rf_sr}) \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',cte_Ptr (mdbNext (cteMDBNode rv))) ({s'. (sa, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned_long = from_bool (isMDBParentOf rv rva)\<rbrace>)
 2. \<And>rv s rva rv' t t'. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI) (?y'859 rv s rva rv')
 3. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P861 rv rva) (?Q859 rv s rva) [SKIP] (cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))) (?y'859 rv s rva (from_bool (isMDBParentOf rv rva)))
 4. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. ?Q859 rv s rva)
 5. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> (?P861 rv cte and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rva sa. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) rva) (mdbNext (cteMDBNode rv))) sa \<and> (sa, s') \<in> rf_sr} \<subseteq> {s. \<exists>ctea cte_a. cslift s (cte_Ptr slot') = Some cte_a \<and> ccte_relation ctea cte_a \<and> (\<exists>cteb cte_b. cslift s (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte_b \<and> ccte_relation cteb cte_b \<and> capAligned (cteCap cteb) \<and> Ex (valid_cap' (cteCap ctea)) \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = from_bool (isMDBParentOf ctea cteb) \<longrightarrow> (sa, s\<lparr>ret__unsigned_long_' := from_bool (isMDBParentOf ctea cteb)\<rparr>) \<in> rf_sr \<and> from_bool (isMDBParentOf ctea cteb) = from_bool (isMDBParentOf rv rva)))}
 2. \<And>rv s rva rv' t t'. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI) (?y'859 rv s rva rv')
 3. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P861 rv rva) (?Q859 rv s rva) [SKIP] (cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))) (?y'859 rv s rva (from_bool (isMDBParentOf rv rva)))
 4. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. ?Q859 rv s rva)
 5. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> (?P861 rv cte and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rva sa x. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap; mdbNext (cteMDBNode rv) \<noteq> nullPointer; ctes_of sa slot' = Some rv; invs' sa; ctes_of sa (mdbNext (cteMDBNode rv)) = Some rva; (sa, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<exists>ctea cte_a. cslift x (cte_Ptr slot') = Some cte_a \<and> ccte_relation ctea cte_a \<and> (\<exists>cteb cte_b. cslift x (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte_b \<and> ccte_relation cteb cte_b \<and> capAligned (cteCap cteb) \<and> Ex (valid_cap' (cteCap ctea)) \<and> isMDBParentOf ctea cteb = isMDBParentOf rv rva)
 2. \<And>rv s rva rv' t t'. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI) (?y'859 rv s rva rv')
 3. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P861 rv rva) (?Q859 rv s rva) [SKIP] (cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))) (?y'859 rv s rva (from_bool (isMDBParentOf rv rva)))
 4. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. ?Q859 rv s rva)
 5. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> (?P861 rv cte and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rva sa x. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap; mdbNext (cteMDBNode rv) \<noteq> nullPointer; ctes_of sa slot' = Some rv; invs' sa; ctes_of sa (mdbNext (cteMDBNode rv)) = Some rva; (sa, x) \<in> rf_sr; valid_cap' (cteCap rv) sa\<rbrakk> \<Longrightarrow> \<exists>ctea cte_a. cslift x (cte_Ptr slot') = Some cte_a \<and> ccte_relation ctea cte_a \<and> (\<exists>cteb cte_b. cslift x (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte_b \<and> ccte_relation cteb cte_b \<and> capAligned (cteCap cteb) \<and> Ex (valid_cap' (cteCap ctea)) \<and> isMDBParentOf ctea cteb = isMDBParentOf rv rva)
 2. \<And>rv s rva rv' t t'. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI) (?y'859 rv s rva rv')
 3. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P861 rv rva) (?Q859 rv s rva) [SKIP] (cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))) (?y'859 rv s rva (from_bool (isMDBParentOf rv rva)))
 4. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. ?Q859 rv s rva)
 5. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> (?P861 rv cte and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rva sa x. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap; mdbNext (cteMDBNode rv) \<noteq> nullPointer; ctes_of sa slot' = Some rv; invs' sa; ctes_of sa (mdbNext (cteMDBNode rv)) = Some rva; (sa, x) \<in> rf_sr; valid_cap' (cteCap rv) sa; valid_cap' (cteCap rva) sa\<rbrakk> \<Longrightarrow> \<exists>ctea cte_a. cslift x (cte_Ptr slot') = Some cte_a \<and> ccte_relation ctea cte_a \<and> (\<exists>cteb cte_b. cslift x (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte_b \<and> ccte_relation cteb cte_b \<and> capAligned (cteCap cteb) \<and> Ex (valid_cap' (cteCap ctea)) \<and> isMDBParentOf ctea cteb = isMDBParentOf rv rva)
 2. \<And>rv s rva rv' t t'. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI) (?y'859 rv s rva rv')
 3. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P861 rv rva) (?Q859 rv s rva) [SKIP] (cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))) (?y'859 rv s rva (from_bool (isMDBParentOf rv rva)))
 4. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. ?Q859 rv s rva)
 5. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> (?P861 rv cte and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rva sa x. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap; mdbNext (cteMDBNode rv) \<noteq> nullPointer; invs' sa; (sa, x) \<in> rf_sr; valid_cap' (cteCap rv) sa; valid_cap' (cteCap rva) sa; \<exists>cte'. cslift x (cte_Ptr slot') = Some cte' \<and> cte_lift cte' \<noteq> None \<and> rv = cte_to_H (the (cte_lift cte')) \<and> c_valid_cte cte'; \<exists>cte'. cslift x (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cte_lift cte' \<noteq> None \<and> rva = cte_to_H (the (cte_lift cte')) \<and> c_valid_cte cte'\<rbrakk> \<Longrightarrow> \<exists>ctea cte_a. cslift x (cte_Ptr slot') = Some cte_a \<and> ccte_relation ctea cte_a \<and> (\<exists>cteb cte_b. cslift x (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte_b \<and> ccte_relation cteb cte_b \<and> capAligned (cteCap cteb) \<and> Ex (valid_cap' (cteCap ctea)) \<and> isMDBParentOf ctea cteb = isMDBParentOf rv rva)
 2. \<And>rv s rva rv' t t'. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI) (?y'859 rv s rva rv')
 3. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P861 rv rva) (?Q859 rv s rva) [SKIP] (cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))) (?y'859 rv s rva (from_bool (isMDBParentOf rv rva)))
 4. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. ?Q859 rv s rva)
 5. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> (?P861 rv cte and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s sa x cte' cte'a y ya. \<lbrakk>mdbNext_CL (cteMDBNode_CL y) \<noteq> 0; (cte_to_H y, s) \<in> fst (getCTE slot' s'); cap_to_H (cap_CL y) \<noteq> capability.NullCap; mdbNext_CL (cteMDBNode_CL y) \<noteq> nullPointer; invs' sa; (sa, x) \<in> rf_sr; valid_cap' (cap_to_H (cap_CL y)) sa; valid_cap' (cap_to_H (cap_CL ya)) sa; cslift x (cte_Ptr slot') = Some cte'; cslift x (cte_Ptr (mdbNext_CL (cteMDBNode_CL y))) = Some cte'a; cte_lift cte' = Some y; cte_lift cte'a = Some ya; c_valid_cte cte'; c_valid_cte cte'a\<rbrakk> \<Longrightarrow> capAligned (cap_to_H (cap_CL ya)) \<and> Ex (valid_cap' (cap_to_H (cap_CL y)))
 2. \<And>rv s rva rv' t t'. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI) (?y'859 rv s rva rv')
 3. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P861 rv rva) (?Q859 rv s rva) [SKIP] (cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))) (?y'859 rv s rva (from_bool (isMDBParentOf rv rva)))
 4. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. ?Q859 rv s rva)
 5. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> (?P861 rv cte and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s rva rv' t t'. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_long_' rv' t t' (\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI) (?y'859 rv s rva rv')
 2. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P861 rv rva) (?Q859 rv s rva) [SKIP] (cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))) (?y'859 rv s rva (from_bool (isMDBParentOf rv rva)))
 3. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. ?Q859 rv s rva)
 4. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> (?P861 rv cte and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P861 rv rva) (?Q859 rv s rva) [SKIP] (cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))) (\<acute>ret__int :== (if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. ?Q859 rv s rva)
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> (?P861 rv cte and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P861 rv rva) (?G'1244 rv s rva) [SKIP] (cutMon (\<lambda>s'. (rva, s') \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))) (IF (if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'1244 rv s rva})
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> (?P861 rv cte and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rva sa. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer); (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P861 rv rva) (?G'1244 rv s rva) [SKIP] (cutMon ((=) sa) (whenE (isMDBParentOf rv rva) (doE y <- cteDelete (mdbNext (cteMDBNode rv)) True;
y <- preemptionPoint;
cteRevoke slot'
odE))) (IF (if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'1244 rv s rva})
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> (?P861 rv cte and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P861 rv rva) (?G'1244 rv s rva) [SKIP] (if isMDBParentOf rv rva then doE rva <- cutMon ((=) sa) (cteDelete (mdbNext (cteMDBNode rv)) True);
cutMon (\<lambda>s'. (Inr (), s') \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)) (doE y <- preemptionPoint;
cteRevoke slot'
odE)
odE else cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'1244 rv s rva})
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> (?P861 rv cte and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1511 rv rva) (?S1515 rv s rva) [SKIP] (doE rva <- cutMon ((=) sa) (cteDelete (mdbNext (cteMDBNode rv)) True);
cutMon (\<lambda>s'. (Inr (), s') \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)) (doE y <- preemptionPoint;
cteRevoke slot'
odE)
odE) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 3. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> ?S1515 rv s rva) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 4. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ?Q1511 rv cte s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1511 rv rva) (?R'1521 rv s rva) [SKIP] (doE rva <- cutMon ((=) sa) (cteDelete (mdbNext (cteMDBNode rv)) True);
cutMon (\<lambda>s'. (Inr (), s') \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)) (doE y <- preemptionPoint;
cteRevoke slot'
odE)
odE) (\<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 3. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> ?R'1521 rv s rva \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 4. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ?Q1511 rv cte s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1511 rv rva) (?R'1521 rv s rva) [SKIP] (doE rva <- cteDelete (mdbNext (cteMDBNode rv)) True;
cutMon (\<lambda>s'. (Inr (), s') \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)) (doE y <- preemptionPoint;
cteRevoke slot'
odE)
odE) (\<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 3. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> ?R'1521 rv s rva \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 4. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ?Q1511 rv cte s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1511 rv rva) (?R'1521 rv s rva) [SKIP] (doE rva <- cteDelete (mdbNext (cteMDBNode rv)) True;
cutMon (\<lambda>s'. (Inr (), s') \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)) (doE y <- preemptionPoint;
cteRevoke slot'
odE)
odE) (\<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 3. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> ?R'1521 rv s rva \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 4. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ?Q1511 rv cte s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv s rva sa rvb status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; dc rvb (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1544 rv s rva sa rvb) (?Q'1564 rv s rva rvb status) [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)) (doE y <- preemptionPoint;
cteRevoke slot'
odE)) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. status)
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 3. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>?Q1544 rv s rva sa\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 4. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 5. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. dc rvb (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q'1564 rv s rva rvb (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 6. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv s rva sa status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1544 rv s rva sa ()) (?Q'1564 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)) (doE y <- preemptionPoint;
cteRevoke slot'
odE)) (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 3. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>?Q1544 rv s rva sa\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 4. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 5. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. dc rvb (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q'1564 rv s rva rvb (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 6. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv s rva sa status sb. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1544 rv s rva sa ()) (?Q'1564 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (doE rv <- cutMon ((=) sb) preemptionPoint;
cutMon (\<lambda>s'. (Inr rv, s') \<in> fst (preemptionPoint sb)) (cteRevoke slot')
odE) (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 3. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>?Q1544 rv s rva sa\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 4. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 5. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. dc rvb (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q'1564 rv s rva rvb (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 6. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv s rva sa status sb. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1544 rv s rva sa ()) (?Q'1564 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (doE a <- preemptionPoint;
cutMon (\<lambda>s'. (Inr a, s') \<in> fst (preemptionPoint sb)) (cteRevoke slot')
odE) (\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 3. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>?Q1544 rv s rva sa\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 4. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 5. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. dc rvb (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q'1564 rv s rva rvb (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 6. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>rv s rva sa statusa sb rvb status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa); dc rvb (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1697 rv s rva sa statusa sb rvb) (?Q'1716 rv s rva rvb status) [SKIP] (cutMon (\<lambda>s'. (Inr rvb, s') \<in> fst (preemptionPoint sb)) (cteRevoke slot')) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. status)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>rv s rva sa statusa sb err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1697 rv s rva sa statusa sb err) (?Q''1714 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 3. \<And>rv s rva sa status sb. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)\<rbrakk> \<Longrightarrow> \<lbrace>?R1709 rv s rva sa ()\<rbrace> preemptionPoint \<lbrace>?Q1697 rv s rva sa status sb\<rbrace>, \<lbrace>?QE1697 rv s rva sa status sb\<rbrace>
 4. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 5. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>\<lambda>a. invs' and ?R1709 rv s rva sa a\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 6. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 7. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. dc rvb (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sa. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rvc. dc rvc (K rvb (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> ?Q'1715 rv s rva rvb (ret__unsigned_long_' t) ta rvc)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> ?Q''1713 rv s rva rvb (ret__unsigned_long_' t) ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 8. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 9. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>rv s rva t rvb. ?Q'1716 rv s rva rvb (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rva. ?Q'1715 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rva t err. ?Q''1714 rv s rva err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rva. ?Q''1713 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) proof (prove)
goal (10 subgoals):
 1. \<And>rv s rva sa statusa sb status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1697 rv s rva sa (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) sb ()) (?Q'1716 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (preemptionPoint sb)) (cteRevoke slot')) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>rv s rva sa statusa sb err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1697 rv s rva sa statusa sb err) (?Q''1714 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 3. \<And>rv s rva sa status sb. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)\<rbrakk> \<Longrightarrow> \<lbrace>?R1709 rv s rva sa ()\<rbrace> preemptionPoint \<lbrace>?Q1697 rv s rva sa status sb\<rbrace>, \<lbrace>?QE1697 rv s rva sa status sb\<rbrace>
 4. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 5. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>\<lambda>a. invs' and ?R1709 rv s rva sa a\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 6. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 7. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. dc rvb (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sa. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rvc. dc rvc (K rvb (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> ?Q'1715 rv s rva rvb (ret__unsigned_long_' t) ta rvc)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> ?Q''1713 rv s rva rvb (ret__unsigned_long_' t) ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 8. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 9. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>rv s rva t rvb. ?Q'1716 rv s rva rvb (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rva. ?Q'1715 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rva t err. ?Q''1714 rv s rva err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rva. ?Q''1713 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) proof (prove)
goal (10 subgoals):
 1. \<And>rv s rva sa statusa sb status sc. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sc) \<in> fst (preemptionPoint sb)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1697 rv s rva sa (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) sb ()) (?Q'1716 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (cutMon ((=) sc) (cteRevoke slot')) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>rv s rva sa statusa sb err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1697 rv s rva sa statusa sb err) (?Q''1714 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 3. \<And>rv s rva sa status sb. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)\<rbrakk> \<Longrightarrow> \<lbrace>?R1709 rv s rva sa ()\<rbrace> preemptionPoint \<lbrace>?Q1697 rv s rva sa status sb\<rbrace>, \<lbrace>?QE1697 rv s rva sa status sb\<rbrace>
 4. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 5. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>\<lambda>a. invs' and ?R1709 rv s rva sa a\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 6. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 7. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. dc rvb (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sa. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rvc. dc rvc (K rvb (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> ?Q'1715 rv s rva rvb (ret__unsigned_long_' t) ta rvc)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> ?Q''1713 rv s rva rvb (ret__unsigned_long_' t) ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 8. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 9. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>rv s rva t rvb. ?Q'1716 rv s rva rvb (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rva. ?Q'1715 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rva t err. ?Q''1714 rv s rva err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rva. ?Q''1713 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) proof (prove)
goal (11 subgoals):
 1. \<And>rv s rva sa statusa sb status sc. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sc) \<in> fst (preemptionPoint sb)\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1697 rv s rva sa (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) sb ()) (?Q'1716 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (cutMon ((=) sc) (cteRevoke slot')) (?s2088 rv s rva sa statusa sb status sc)
 2. \<And>rv s rva sa statusa sb status sc. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sc) \<in> fst (preemptionPoint sb)\<rbrakk> \<Longrightarrow> ?s2088 rv s rva sa statusa sb status sc = (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 3. \<And>rv s rva sa statusa sb err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1697 rv s rva sa statusa sb err) (?Q''1714 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 4. \<And>rv s rva sa status sb. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)\<rbrakk> \<Longrightarrow> \<lbrace>?R1709 rv s rva sa ()\<rbrace> preemptionPoint \<lbrace>?Q1697 rv s rva sa status sb\<rbrace>, \<lbrace>?QE1697 rv s rva sa status sb\<rbrace>
 5. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 6. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>\<lambda>a. invs' and ?R1709 rv s rva sa a\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 7. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 8. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. dc rvb (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sa. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rvc. dc rvc (K rvb (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> ?Q'1715 rv s rva rvb (ret__unsigned_long_' t) ta rvc)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> ?Q''1713 rv s rva rvb (ret__unsigned_long_' t) ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 9. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 10. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv s rva t rvb. ?Q'1716 rv s rva rvb (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>rv s rva. ?Q'1715 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rva t err. ?Q''1714 rv s rva err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rva. ?Q''1713 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) proof (prove)
goal (10 subgoals):
 1. \<And>rv s rva sa statusa sb status sc. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa); status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sc) \<in> fst (preemptionPoint sb)\<rbrakk> \<Longrightarrow> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) = (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>rv s rva sa statusa sb err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1697 rv s rva sa statusa sb err) (?Q''1714 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 3. \<And>rv s rva sa status sb. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)\<rbrakk> \<Longrightarrow> \<lbrace>?R1709 rv s rva sa ()\<rbrace> preemptionPoint \<lbrace>\<lambda>a. invs' and sch_act_simple\<rbrace>, \<lbrace>?QE1697 rv s rva sa status sb\<rbrace>
 4. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 5. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>\<lambda>a. invs' and ?R1709 rv s rva sa a\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 6. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 7. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. dc rvb (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sa. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K rvb (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> ?Q''1713 rv s rva rvb (ret__unsigned_long_' t) ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 8. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 9. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>rv s rva t err. ?Q''1714 rv s rva err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rva. ?Q''1713 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) proof (prove)
goal (9 subgoals):
 1. \<And>rv s rva sa statusa sb err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1697 rv s rva sa statusa sb err) (?Q''1714 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>a. rv')
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>rv s rva sa status sb. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)\<rbrakk> \<Longrightarrow> \<lbrace>?R1709 rv s rva sa ()\<rbrace> preemptionPoint \<lbrace>\<lambda>a. invs' and sch_act_simple\<rbrace>, \<lbrace>?QE1697 rv s rva sa status sb\<rbrace>
 3. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 4. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>\<lambda>a. invs' and ?R1709 rv s rva sa a\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 5. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 6. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. dc rvb (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sa. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K rvb (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> ?Q''1713 rv s rva rvb (ret__unsigned_long_' t) ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 7. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 8. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>rv s rva t err. ?Q''1714 rv s rva err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rva. ?Q''1713 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) proof (prove)
goal (10 subgoals):
 1. \<And>rv s rva sa statusa sb err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv' status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1697 rv s rva sa (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) sb err) (?P'2154 rv s rva err rv' status) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>rv s rva sa statusa sb err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv' status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2153 rv s rva err rv' status) return_C ret__unsigned_long_'_update (\<lambda>a. rv') {},UNIV
 3. \<And>rv s rva sa status sb. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)\<rbrakk> \<Longrightarrow> \<lbrace>?R1709 rv s rva sa ()\<rbrace> preemptionPoint \<lbrace>\<lambda>a. invs' and sch_act_simple\<rbrace>, \<lbrace>?QE1697 rv s rva sa status sb\<rbrace>
 4. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 5. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>\<lambda>a. invs' and ?R1709 rv s rva sa a\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 6. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 7. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. dc rvb (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sa. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K rvb (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> ?P'2151 rv s rva rvb (ret__unsigned_long_' t) ta err \<inter> ?R'2150 rv s rva rvb (ret__unsigned_long_' t) ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 8. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 9. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>rv s rva t err. ?P'2154 rv s rva err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rva. ?P'2151 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
\<lambda>rv s rva t err. ?R'2153 rv s rva err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rva. ?R'2150 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) proof (prove)
goal (9 subgoals):
 1. \<And>rv s rva sa statusa sb err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv' status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2153 rv s rva err rv' status) return_C ret__unsigned_long_'_update (\<lambda>a. rv') {},UNIV
 2. \<And>rv s rva sa status sb. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)\<rbrakk> \<Longrightarrow> \<lbrace>?R1709 rv s rva sa ()\<rbrace> preemptionPoint \<lbrace>\<lambda>a. invs' and sch_act_simple\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 4. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>\<lambda>a. invs' and ?R1709 rv s rva sa a\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 5. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 6. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. dc rvb (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {sa. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rv. dc rv (K rvb (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (sa\<lparr>globals := globals ta\<rparr>) \<in> {s. id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<and> cintr err (id (ret__unsigned_long_' ta)) (errstate s)} \<inter> ?R'2150 rv s rva rvb (ret__unsigned_long_' t) ta err))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 7. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 8. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>rv s rva t err. ?R'2153 rv s rva err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>rv s rva. ?R'2150 rv s rva () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) proof (prove)
goal (8 subgoals):
 1. \<And>rv s rva sa status sb. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)\<rbrakk> \<Longrightarrow> \<lbrace>?R1709 rv s rva sa ()\<rbrace> preemptionPoint \<lbrace>\<lambda>a. invs' and sch_act_simple\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 3. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>\<lambda>a. invs' and ?R1709 rv s rva sa a\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 4. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 5. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> {s. id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<and> cintr err (id (ret__unsigned_long_' ta)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 6. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>rv s rva sa status sb f sc. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple) (ksWorkUnitsCompleted_update f sc) = (invs' and sch_act_simple) sc
 2. \<And>rv s rva sa status sb. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)\<rbrakk> \<Longrightarrow> irq_state_independent_H (invs' and sch_act_simple)
 3. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 4. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> (invs' and sch_act_simple) a)\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 5. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 6. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> {s. id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<and> cintr err (id (ret__unsigned_long_' ta)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 7. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 8. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv s rva sa status sb. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (Inr (), sb) \<in> fst (cteDelete (mdbNext (cteMDBNode rv)) True sa)\<rbrakk> \<Longrightarrow> irq_state_independent_H (invs' and sch_act_simple)
 2. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 3. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> (invs' and sch_act_simple) a)\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 4. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 5. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> {s. id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<and> cintr err (id (ret__unsigned_long_' ta)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 6. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?Q''1562 rv s rva err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>status :== CALL preemptionPoint_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
(\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> (invs' and sch_act_simple) a)\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 3. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 4. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> {s. id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<and> cintr err (id (ret__unsigned_long_' ta)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?Q''1562 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 5. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv' status\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1544 rv s rva sa err) (?P'2189 rv s rva err rv' status) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 2. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv' status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2190 rv s rva err rv' status) return_C ret__unsigned_long_'_update (\<lambda>s. rv') {},UNIV
 3. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> (invs' and sch_act_simple) a)\<rbrace>, \<lbrace>?QE1544 rv s rva sa\<rbrace>
 4. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 5. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> {s. id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<and> cintr err (id (ret__unsigned_long_' ta)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> ?P'2189 rv s rva err (ret__unsigned_long_' t) (errstate t) \<inter> ?R'2190 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 6. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 7. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>rv s rva sa err rv' status. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva; rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv' status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2190 rv s rva err rv' status) return_C ret__unsigned_long_'_update (\<lambda>s. rv') {},UNIV
 2. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> (invs' and sch_act_simple) a)\<rbrace>, \<lbrace>\<lambda>err _. True\<rbrace>
 3. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 4. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> {s. id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<and> cintr err (id (ret__unsigned_long_' ta)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (sa\<lparr>globals := globals t\<rparr>) \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> cintr err (id (ret__unsigned_long_' t)) (errstate s)} \<inter> ?R'2190 rv s rva err (ret__unsigned_long_' t) (errstate t)))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 5. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 6. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<lbrace>?R1557 rv rva\<rbrace> cteDelete (mdbNext (cteMDBNode rv)) True \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> (invs' and sch_act_simple) a)\<rbrace>, \<lbrace>\<lambda>err _. True\<rbrace>
 2. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 3. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> {s. id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<and> cintr err (id (ret__unsigned_long_' ta)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> cintr err (id (ret__unsigned_long_' t)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 4. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 5. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and ?R1557 rv cte) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?T1517 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (IF isMDBParentOf rv rva THEN
  \<acute>status :== CALL cteDelete_'proc(cte_Ptr (mdbNext (cteMDBNode rv)),SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>status :== CALL cteDelete_'proc(\<acute>nextPtr,SCAST(32 signed \<rightarrow> 32) true);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>status :== CALL preemptionPoint_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot'} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot'\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>nextPtr :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>nextPtr \<noteq> NULL then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL isMDBParentOf_'proc(cte_Ptr slot',\<acute>nextPtr);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI)
 2. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> {s. id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<and> cintr err (id (ret__unsigned_long_' ta)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> cintr err (id (ret__unsigned_long_' t)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?T1517 rv s rva)}})
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and K True) a \<and> True \<and> (invs' and sch_act_simple and K True) a \<and> (invs' and sch_act_simple and (\<lambda>s. \<not> True \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) s)) a)) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?R'2242 rv s rva) [SKIP] (cutMon ((=) sa) (returnOk ())) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> {s. id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<and> cintr err (id (ret__unsigned_long_' ta)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> cintr err (id (ret__unsigned_long_' t)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?R'2242 rv s rva \<inter> - \<lbrace>isMDBParentOf rv rva\<rbrace>)}})
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and K True) a \<and> True \<and> (invs' and sch_act_simple and K True) a \<and> (invs' and sch_act_simple and (\<lambda>s. \<not> True \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) s)) a)) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1513 rv rva) (?R'2242 rv s rva) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {sa. sa\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (isMDBParentOf rv rva \<longrightarrow> sa \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> {s. id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<and> cintr err (id (ret__unsigned_long_' ta)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> cintr err (id (ret__unsigned_long_' t)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> sa \<in> ?R'2242 rv s rva \<inter> - \<lbrace>isMDBParentOf rv rva\<rbrace>)}})
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and K True) a \<and> True \<and> (invs' and sch_act_simple and K True) a \<and> (invs' and sch_act_simple and (\<lambda>s. \<not> True \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) s)) a)) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> ?R1513 rv cte s)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rva sa. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (returnOk () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {s. s\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (isMDBParentOf rv rva \<longrightarrow> s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> {s. id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<and> cintr err (id (ret__unsigned_long_' ta)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> cintr err (id (ret__unsigned_long_' t)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>isMDBParentOf rv rva\<rbrace>)}})
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and K True) a \<and> True \<and> (invs' and sch_act_simple and K True) a \<and> (invs' and sch_act_simple and (\<lambda>s. \<not> True \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) s)) a)) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv s rva sa \<sigma>. \<lbrakk>mdbNext (cteMDBNode rv) \<noteq> 0; (rv, s) \<in> fst (getCTE slot' s'); cteCap rv \<noteq> capability.NullCap \<and> mdbNext (cteMDBNode rv) \<noteq> nullPointer; (rva, sa) \<in> fst (getCTE (mdbNext (cteMDBNode rv)) s); \<not> isMDBParentOf rv rva\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (returnOk () \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {s. s\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (isMDBParentOf rv rva \<longrightarrow> s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> {s. id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<and> cintr err (id (ret__unsigned_long_' ta)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> cintr err (id (ret__unsigned_long_' t)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>isMDBParentOf rv rva\<rbrace>)}})
 3. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 4. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and K True) a \<and> True \<and> (invs' and sch_act_simple and K True) a \<and> (invs' and sch_act_simple and (\<lambda>s. \<not> True \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) s)) a)) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv s rva. \<lbrakk>cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL; (rv, s) \<in> fst (getCTE slot' s'); \<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rvb rv'. rv' = from_bool (isMDBParentOf rv rva)) ret__unsigned_long_' (\<lambda>rvb rv'. {s. s\<lparr>ret__int_' := if from_bool (isMDBParentOf rv rva) \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (isMDBParentOf rv rva \<longrightarrow> s \<in> {s. exposed_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (slot_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s) \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (mdbNext (cteMDBNode rv))\<rbrace> \<inter> \<lbrace>\<acute>exposed = from_bool True\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. s \<in> UNIV} \<inter> {s. \<forall>ta. (id (ret__unsigned_long_' ta) = ret__unsigned_long_' t \<longrightarrow> (\<forall>rva. dc rva (K rv (ret__unsigned_long_' ta)) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> UNIV)) \<and> (id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' ta)) (errstate ta) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' ta) (s\<lparr>globals := globals ta\<rparr>) \<in> {s. id (ret__unsigned_long_' ta) \<noteq> ret__unsigned_long_' t \<and> cintr err (id (ret__unsigned_long_' ta)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))})) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals t\<rparr>) \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> cintr err (id (ret__unsigned_long_' t)) (errstate s)} \<inter> \<lbrace>True\<rbrace>))} \<inter> \<lbrace>isMDBParentOf rv rva\<rbrace>) \<and> (\<not> isMDBParentOf rv rva \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>isMDBParentOf rv rva\<rbrace>)}})
 2. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 3. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and K True) a \<and> True \<and> (invs' and sch_act_simple and K True) a \<and> (invs' and sch_act_simple and (\<lambda>s. \<not> True \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) s)) a)) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>rv. guard_is_UNIV (\<lambda>rva rv'. rv' = mdbNext (cteMDBNode rv)) ret__unsigned_' (\<lambda>rva rv'. {s. nextPtr_'_update (\<lambda>_. cte_Ptr (mdbNext (cteMDBNode rv))) s \<in> {s. s\<lparr>ret__int_' := if cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL then 1 else 0\<rparr> \<in> {s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> {s. (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> s \<in> UNIV) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (mdbNext (cteMDBNode rv))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV})}) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}})
 2. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and K True) a \<and> True \<and> (invs' and sch_act_simple and K True) a \<and> (invs' and sch_act_simple and (\<lambda>s. \<not> True \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) s)) a)) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q\<rbrace> getCTE slot' \<lbrace>\<lambda>rv. (\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap rv = capability.NullCap \<or> mdbNext (cteMDBNode rv) = nullPointer) \<longrightarrow> (\<forall>cte. ctes_of s (mdbNext (cteMDBNode rv)) = Some cte \<longrightarrow> ((\<lambda>s. (isMDBParentOf rv cte \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and K True) a \<and> True \<and> (invs' and sch_act_simple and K True) a \<and> (invs' and sch_act_simple and (\<lambda>s. \<not> True \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode rv)) s)) a)) s) \<and> (\<not> isMDBParentOf rv cte \<longrightarrow> True)) and (cte_wp_at' ((=) rv) slot' and invs' and cte_wp_at' ((=) cte) (mdbNext (cteMDBNode rv)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode rv)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) rv) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))\<rbrace>
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q s \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; (invs' and sch_act_simple) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>_. True) slot' s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) slot' s \<and> ((\<lambda>s. (cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer \<longrightarrow> False) \<and> (\<not> (cteCap cte = capability.NullCap \<or> mdbNext (cteMDBNode cte) = nullPointer) \<longrightarrow> (\<forall>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea \<longrightarrow> ((\<lambda>s. (isMDBParentOf cte ctea \<longrightarrow> ((\<lambda>a. invs' a \<and> sch_act_simple a \<and> (True \<or> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) a)) and (\<lambda>a. True \<and> (invs' and sch_act_simple and K True) a \<and> True \<and> (invs' and sch_act_simple and K True) a \<and> (invs' and sch_act_simple and (\<lambda>s. \<not> True \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s)) a)) s) \<and> (\<not> isMDBParentOf cte ctea \<longrightarrow> True)) and (cte_wp_at' ((=) cte) slot' and invs' and cte_wp_at' ((=) ctea) (mdbNext (cteMDBNode cte)))) s))) \<and> (\<not> cte_Ptr (mdbNext (cteMDBNode cte)) \<noteq> NULL \<longrightarrow> True)) and cte_wp_at' ((=) cte) slot' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot'))) s)) \<and> s' \<in> UNIV \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte. \<lbrakk>(s, s') \<in> rf_sr; invs' s; sch_act_simple s; ctes_of s slot' = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0; cteCap cte = capability.NullCap\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte. \<lbrakk>(s, s') \<in> rf_sr; sch_act_simple s; ctes_of s slot' = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0; cteCap cte = capability.NullCap; valid_mdb' s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte. \<lbrakk>(s, s') \<in> rf_sr; sch_act_simple s; ctes_of s slot' = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0; cteCap cte = capability.NullCap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>s s' x2. \<lbrakk>(s, s') \<in> rf_sr; sch_act_simple s; ctes_of s slot' = Some (CTE capability.NullCap x2); mdbNext x2 \<noteq> 0; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (prove)
goal:
No subgoals!