theory Finalise_IF

lemma rec_del_spec_reads_respects_f:
  assumes domains_distinct[wp]: "pas_domains_distinct aag"
  notes drop_spec_valid[wp_split del] drop_spec_validE[wp_split del]
        drop_spec_ev[wp_split del] rec_del.simps[simp del]
  shows
  "spec_reads_respects_f s aag l
     (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action
                      and pas_refined aag and valid_rec_del_call call and emptyable (slot_rdcall call)
                      and (\<lambda>s. \<not> exposed_rdcall call
                               \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall call) s)
                      and K (case call of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot)
                               | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot)
                               | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and>
                                                                      is_subject aag (obj_ref_of cap)))
     (rec_del call)" proof (induct s rule: rec_del.induct, simp_all only: rec_del_fails drop_spec_ev[OF fail_ev_pre]) case (1 slot exposed s) show ?case apply (rule spec_equiv_valid_guard_imp) apply (simp add: rec_del.simps split_def when_def) apply (wp drop_spec_ev[OF returnOk_ev_pre] drop_spec_ev[OF liftE_ev] hoareE_TrueI
               reads_respects_f[OF empty_slot_reads_respects, where st=st] empty_slot_silc_inv) apply (rule "1.hyps") apply (rule_tac Q'="\<lambda>r s. silc_inv aag st s \<and> is_subject aag (fst slot)" in hoare_post_imp_R) apply (wp validE_validE_R'[OF rec_del_silc_inv_not_transferable] | fastforce simp: silc_inv_def)+ done next case (2 slot exposed s) show ?case apply (simp add: rec_del.simps) apply (rule spec_equiv_valid_guard_imp) apply (wp drop_spec_ev[OF returnOk_ev] drop_spec_ev[OF liftE_ev]
               set_cap_reads_respects_f "2.hyps" preemption_point_inv'
               drop_spec_ev[OF preemption_point_reads_respects_f[where st=st and st'=st']]
               validE_validE_R'[OF rec_del_silc_inv_not_transferable] rec_del_invs
               rec_del_respects(2) rec_del_only_timer_irq_inv
            | simp add: split_def split del: if_split | (rule irq_state_independent_A_conjI, simp)+)+ apply (rule_tac
                    Q'="\<lambda>rv s. emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s \<and>
                               (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and>
                               is_subject aag (fst slot)" in hoare_post_imp_R) apply (wp rec_del_emptyable reduce_zombie_cap_to) apply simp apply (wp drop_spec_ev[OF liftE_ev] set_cap_reads_respects_f[where st=st]
                      set_cap_silc_inv[where st=st] | simp)+ apply (wp replace_cap_invs set_cap_cte_wp_at set_cap_sets final_cap_same_objrefs
                     set_cap_cte_cap_wp_to  hoare_vcg_const_Ball_lift hoare_weak_lift_imp
                     drop_spec_ev[OF liftE_ev] finalise_cap_reads_respects set_cap_silc_inv
                     set_cap_only_timer_irq_inv set_cap_pas_refined_not_transferable
                  | simp add: cte_wp_at_eq_simp
                  | erule finalise_cap_not_reply_master[simplified Inr_in_liftE_simp])+ apply (rule hoare_strengthen_post) apply (rule_tac
                 Q="\<lambda>fin s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s
                         \<and> (\<not> cap_points_to_label aag (fst fin) (pasObjectAbs aag (fst slot))
                            \<longrightarrow> (\<exists>lslot. lslot \<in> slots_holding_overlapping_caps (fst fin) s \<and>
                                         pasObjectAbs aag (fst lslot) = SilcLabel))
                         \<and> einvs s \<and> replaceable s slot (fst fin) rv
                         \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> (fst fin)
                         \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s
                         \<and> (\<forall>t\<in>obj_refs_ac (fst fin). halted_if_tcb t s)
                         \<and> pas_refined aag s
                         \<and> emptyable slot s
                         \<and> simple_sched_action s
                         \<and> pas_cap_cur_auth aag (fst fin)
                         \<and> is_subject aag (fst slot)
                         \<and> (case (fst fin) of Zombie _ _ _ \<Rightarrow> is_subject aag (obj_ref_of (fst fin))
                                                       | _ \<Rightarrow> True)
                         \<and> (is_zombie (fst fin) \<or> fst fin = NullCap)
                         \<and> (is_zombie (fst fin) \<or> fst fin = NullCap)" in hoare_vcg_conj_lift) apply (wp finalise_cap_replaceable Finalise_AC_1.finalise_cap_makes_halted
                     finalise_cap_invs finalise_cap_auth' finalise_cap_ret_is_subject finalise_cap_ret'
                     finalise_cap_silc_inv finalise_cap_ret_is_silc finalise_cap_only_timer_irq_inv)[1] apply (rule finalise_cap_cases[where slot=slot]) apply (clarsimp simp: cte_wp_at_caps_of_state) apply (erule disjE) apply (clarsimp simp: cap_irq_opt_def cte_wp_at_def is_zombie_def gen_obj_refs_eq
                         split: cap.split_asm if_split_asm
                         elim!: ranE dest!: caps_of_state_cteD) apply (clarsimp cong: conj_cong simp: conj_comms) apply (rename_tac word option nat) apply (drule_tac s="{word}" in sym) apply (clarsimp simp: invs_psp_aligned invs_arch_state invs_vspace_objs) apply (rule conjI, fastforce) apply (clarsimp, rule conjI) apply (erule replaceable_zombie_not_transferable) (* WHY *)
           apply (rule conjI) apply (fastforce simp: silc_inv_def) apply (rule conjI) apply (fastforce simp: domain_sep_inv_def domain_sep_inv_cap_def only_timer_irq_inv_def) apply (rule conjI[rotated], force) apply (clarsimp simp: ex_cte_cap_wp_to_def)+ apply (rule_tac x="a" in exI, rule_tac x="b" in exI) apply (clarsimp simp: cte_wp_at_def appropriate_cte_cap_def) apply (drule_tac x="cap" in fun_cong) apply (clarsimp simp: appropriate_cte_cap_def split: cap.splits) apply (clarsimp cong: conj_cong simp: conj_comms) apply (wp drop_spec_ev[OF liftE_ev] is_final_cap_reads_respects | simp)+ apply (rule_tac Q="\<lambda>rva s. rva = is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s \<and>
                                  only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and>
                                  pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and>
                                  invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and>
                                  s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and>
                                  ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s"
                    in hoare_strengthen_post) apply (wp is_final_cap_is_final | simp)+ apply clarsimp apply (rule conjI) apply clarsimp apply (frule silc_inv) apply (erule_tac x=rv in allE, erule_tac x=slot in allE) apply simp apply (erule disjE) apply (drule(1) intra_label_capD) apply (clarsimp simp: cap_points_to_label_def split: cap.splits) apply (simp add: silc_inv_def) apply (force simp: owns_cnode_owns_obj_ref_of_child_cnodes_threads_and_zombies) apply (wp drop_spec_ev reads_respects_f[OF get_cap_rev, where st=st and Q="\<top>"] get_cap_wp
             | simp)+ apply (clarsimp cong: conj_cong simp: invs_valid_objs invs_arch_state invs_psp_aligned) apply (intro conjI impI | clarsimp | assumption | fastforce dest: silc_inv_not_subject)+ apply (erule (1) cap_cur_auth_caps_of_state[rotated]) apply (simp add: cte_wp_at_caps_of_state) apply (fastforce dest: cte_wp_at_valid_objs_valid_cap simp: invs_valid_objs) apply (drule if_unsafe_then_capD) apply (simp add: invs_ifunsafe) apply simp apply (clarsimp simp: ex_cte_cap_wp_to_def) done next case (3 ptr bits n slot s) show ?case apply (simp add: rec_del.simps) apply (rule spec_equiv_valid_guard_imp) apply (wp drop_spec_ev[OF liftE_ev] drop_spec_ev[OF returnOk_ev]
              reads_respects_f[OF cap_swap_for_delete_reads_respects] cap_swap_for_delete_silc_inv
              drop_spec_ev[OF assertE_ev])+ apply (fastforce simp: silc_inv_def) done next case (4 ptr bits n slot s) show ?case apply (simp add: rec_del.simps) apply (rule spec_equiv_valid_guard_imp) apply (wp drop_spec_ev[OF returnOk_ev] drop_spec_ev[OF liftE_ev] set_cap_reads_respects_f
               drop_spec_ev[OF assertE_ev] get_cap_wp "4.hyps"
               reads_respects_f[OF get_cap_rev, where st=st and Q="\<top>"]
               validE_validE_R'[OF rec_del_silc_inv_not_transferable]
            | simp add: in_monad)+ apply (rule_tac Q'="\<lambda> _. silc_inv aag st and
                            K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))"
                  in hoare_post_imp_R) prefer 2 apply (clarsimp) apply (rule conjI, assumption) apply (rule impI) apply (drule silc_invD) apply assumption apply (simp add: intra_label_cap_def) apply (rule exI) apply (rule conjI) apply assumption apply (fastforce simp: cap_points_to_label_def) apply (clarsimp simp: slots_holding_overlapping_caps_def2 ctes_wp_at_def) apply (wp validE_validE_R'[OF rec_del_silc_inv_not_transferable] | simp)+ apply (clarsimp simp: zombie_is_cap_toE cte_wp_at_caps_of_state zombie_ptr_emptyable silc_inv_def) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call call and emptyable (slot_rdcall call) and (\<lambda>s. \<not> exposed_rdcall call \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall call) s) and K (case call of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del call) proof (state)
goal (4 subgoals):
 1. \<And>slot exposed s. spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed)) \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall slot exposed) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and K (case CTEDeleteCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall slot exposed))
 2. \<And>slot exposed s. \<lbrakk>\<And>rv sta rva staa rvb stb rvc stc. \<lbrakk>(Inr rv, sta) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, staa) \<in> fst ((without_preemption $ is_final_cap rv) sta); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) staa); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> spec_reads_respects_f stc aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (fst rvb) slot exposed)); \<And>rv sta rva staa rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, sta) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, staa) \<in> fst ((without_preemption $ is_final_cap rv) sta); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) staa); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> spec_reads_respects_f ste aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed))\<rbrakk> \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed))
 3. \<And>ptr bits n slot s. spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False))
 4. \<And>ptr bits n slot s. (\<And>rv sta. (Inr rv, sta) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> spec_reads_respects_f sta aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall rv False) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and K (case CTEDeleteCall rv False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall rv False))) \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) proof (state)
this:
spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed))

goal (4 subgoals):
 1. \<And>slot exposed s. spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed)) \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall slot exposed) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and K (case CTEDeleteCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall slot exposed))
 2. \<And>slot exposed s. \<lbrakk>\<And>rv sta rva staa rvb stb rvc stc. \<lbrakk>(Inr rv, sta) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, staa) \<in> fst ((without_preemption $ is_final_cap rv) sta); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) staa); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> spec_reads_respects_f stc aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (fst rvb) slot exposed)); \<And>rv sta rva staa rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, sta) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, staa) \<in> fst ((without_preemption $ is_final_cap rv) sta); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) staa); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> spec_reads_respects_f ste aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed))\<rbrakk> \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed))
 3. \<And>ptr bits n slot s. spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False))
 4. \<And>ptr bits n slot s. (\<And>rv sta. (Inr rv, sta) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> spec_reads_respects_f sta aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall rv False) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and K (case CTEDeleteCall rv False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall rv False))) \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) proof (prove)
goal (1 subgoal):
 1. spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall slot exposed) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and K (case CTEDeleteCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall slot exposed)) proof (prove)
goal (2 subgoals):
 1. spec_reads_respects_f s aag l ?P' (rec_del (CTEDeleteCall slot exposed))
 2. \<And>s. (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall slot exposed) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and K (case CTEDeleteCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<Longrightarrow> ?P' s proof (prove)
goal (2 subgoals):
 1. spec_reads_respects_f s aag l ?P' (doE p <- rec_del (FinaliseSlotCall slot exposed);
y <- liftE (if exposed \<or> fst p then empty_slot slot (snd p) else return ());
returnOk undefined
odE)
 2. \<And>s. (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall slot exposed) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and K (case CTEDeleteCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<Longrightarrow> ?P' s proof (prove)
goal (3 subgoals):
 1. spec_reads_respects_f s aag l ?P'4 (rec_del (FinaliseSlotCall slot exposed))
 2. \<lbrace>?P''4\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. ((exposed \<or> fst rv \<longrightarrow> (silc_inv aag st and K (aag_can_read aag (fst slot)) and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel)) s) \<and> (\<not> (exposed \<or> fst rv) \<longrightarrow> True)) \<and> ?P''7 rv s\<rbrace>, -
 3. \<And>s. (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall slot exposed) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and K (case CTEDeleteCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<Longrightarrow> ?P'4 s \<and> ?P''4 s proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P''4\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>rv s. ((exposed \<or> fst rv \<longrightarrow> (silc_inv aag st and K (aag_can_read aag (fst slot)) and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel)) s) \<and> (\<not> (exposed \<or> fst rv) \<longrightarrow> True)) \<and> ?P''7 rv s\<rbrace>, -
 2. \<And>s. (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall slot exposed) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and K (case CTEDeleteCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> ?P''4 s proof (prove)
goal (3 subgoals):
 1. \<lbrace>?P''4\<rbrace> rec_del (FinaliseSlotCall slot exposed) \<lbrace>\<lambda>r s. silc_inv aag st s \<and> is_subject aag (fst slot)\<rbrace>, -
 2. \<And>rv s. silc_inv aag st s \<and> is_subject aag (fst slot) \<Longrightarrow> ((exposed \<or> fst rv \<longrightarrow> (silc_inv aag st and K (aag_can_read aag (fst slot)) and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel)) s) \<and> (\<not> (exposed \<or> fst rv) \<longrightarrow> True)) \<and> ?P''7 rv s
 3. \<And>s. (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall slot exposed) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and K (case CTEDeleteCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> ?P''4 s proof (prove)
goal:
No subgoals! proof (state)
this:
spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall slot exposed) and emptyable (slot_rdcall (CTEDeleteCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall slot exposed)) s) and K (case CTEDeleteCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall slot exposed))

goal (3 subgoals):
 1. \<And>slot exposed s. \<lbrakk>\<And>rv sta rva staa rvb stb rvc stc. \<lbrakk>(Inr rv, sta) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, staa) \<in> fst ((without_preemption $ is_final_cap rv) sta); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) staa); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> spec_reads_respects_f stc aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (fst rvb) slot exposed)); \<And>rv sta rva staa rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, sta) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, staa) \<in> fst ((without_preemption $ is_final_cap rv) sta); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) staa); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> spec_reads_respects_f ste aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed))\<rbrakk> \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed))
 2. \<And>ptr bits n slot s. spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False))
 3. \<And>ptr bits n slot s. (\<And>rv sta. (Inr rv, sta) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> spec_reads_respects_f sta aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall rv False) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and K (case CTEDeleteCall rv False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall rv False))) \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) proof (state)
goal (3 subgoals):
 1. \<And>slot exposed s. \<lbrakk>\<And>rv sta rva staa rvb stb rvc stc. \<lbrakk>(Inr rv, sta) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, staa) \<in> fst ((without_preemption $ is_final_cap rv) sta); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) staa); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> spec_reads_respects_f stc aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (fst rvb) slot exposed)); \<And>rv sta rva staa rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, sta) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, staa) \<in> fst ((without_preemption $ is_final_cap rv) sta); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) staa); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> spec_reads_respects_f ste aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed))\<rbrakk> \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed))
 2. \<And>ptr bits n slot s. spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False))
 3. \<And>ptr bits n slot s. (\<And>rv sta. (Inr rv, sta) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> spec_reads_respects_f sta aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall rv False) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and K (case CTEDeleteCall rv False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall rv False))) \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) proof (state)
this:
\<lbrakk>(Inr ?rv, ?st) \<in> fst ((without_preemption $ get_cap slot) s); ?rv \<noteq> NullCap; (Inr ?rva, ?sta) \<in> fst ((without_preemption $ is_final_cap ?rv) ?st); (Inr ?rvb, ?stb) \<in> fst ((without_preemption $ finalise_cap ?rv ?rva) ?sta); \<not> cap_removeable (fst ?rvb) slot; \<not> (cap_cyclic_zombie (fst ?rvb) slot \<and> \<not> exposed); (Inr ?rvc, ?stc) \<in> fst ((without_preemption $ set_cap (fst ?rvb) slot) ?stb)\<rbrakk> \<Longrightarrow> spec_reads_respects_f ?stc aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (fst ?rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst ?rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst ?rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst ?rvb) slot exposed)) s) and K (case ReduceZombieCall (fst ?rvb) slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (fst ?rvb) slot exposed))
\<lbrakk>(Inr ?rv, ?st) \<in> fst ((without_preemption $ get_cap slot) s); ?rv \<noteq> NullCap; (Inr ?rva, ?sta) \<in> fst ((without_preemption $ is_final_cap ?rv) ?st); (Inr ?rvb, ?stb) \<in> fst ((without_preemption $ finalise_cap ?rv ?rva) ?sta); \<not> cap_removeable (fst ?rvb) slot; \<not> (cap_cyclic_zombie (fst ?rvb) slot \<and> \<not> exposed); (Inr ?rvc, ?stc) \<in> fst ((without_preemption $ set_cap (fst ?rvb) slot) ?stb); (Inr ?rvd, ?std) \<in> fst (rec_del (ReduceZombieCall (fst ?rvb) slot exposed) ?stc); (Inr ?rve, ?ste) \<in> fst (preemption_point ?std)\<rbrakk> \<Longrightarrow> spec_reads_respects_f ?ste aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed))

goal (3 subgoals):
 1. \<And>slot exposed s. \<lbrakk>\<And>rv sta rva staa rvb stb rvc stc. \<lbrakk>(Inr rv, sta) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, staa) \<in> fst ((without_preemption $ is_final_cap rv) sta); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) staa); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb)\<rbrakk> \<Longrightarrow> spec_reads_respects_f stc aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (fst rvb) slot exposed)); \<And>rv sta rva staa rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, sta) \<in> fst ((without_preemption $ get_cap slot) s); rv \<noteq> NullCap; (Inr rva, staa) \<in> fst ((without_preemption $ is_final_cap rv) sta); (Inr rvb, stb) \<in> fst ((without_preemption $ finalise_cap rv rva) staa); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed); (Inr rvc, stc) \<in> fst ((without_preemption $ set_cap (fst rvb) slot) stb); (Inr rvd, std) \<in> fst (rec_del (ReduceZombieCall (fst rvb) slot exposed) stc); (Inr rve, ste) \<in> fst (preemption_point std)\<rbrakk> \<Longrightarrow> spec_reads_respects_f ste aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed))\<rbrakk> \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed))
 2. \<And>ptr bits n slot s. spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False))
 3. \<And>ptr bits n slot s. (\<And>rv sta. (Inr rv, sta) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> spec_reads_respects_f sta aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall rv False) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and K (case CTEDeleteCall rv False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall rv False))) \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) proof (prove)
goal (1 subgoal):
 1. spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed)) proof (prove)
goal (1 subgoal):
 1. spec_reads_respects_f s aag l (\<lambda>a. silc_inv aag st a \<and> only_timer_irq_inv irq st' a \<and> invs a \<and> valid_list a \<and> valid_sched a \<and> simple_sched_action a \<and> pas_refined aag a \<and> emptyable slot a \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot a) \<and> is_subject aag (fst slot)) (doE cap <- liftE (get_cap slot);
if cap = NullCap then returnOk (True, NullCap) else doE is_final <- without_preemption $ is_final_cap cap;
(remainder, cleanup_info) <- without_preemption $ finalise_cap cap is_final;
if cap_removeable remainder slot then returnOk (True, cleanup_info) else if cap_cyclic_zombie remainder slot \<and> \<not> exposed then doE without_preemption $ set_cap remainder slot;
returnOk (False, NullCap)
odE else doE without_preemption $ set_cap remainder slot;
rec_del (ReduceZombieCall remainder slot exposed);
preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE
odE) proof (prove)
goal (2 subgoals):
 1. spec_reads_respects_f s aag l ?P'3 (doE cap <- liftE (get_cap slot);
if cap = NullCap then returnOk (True, NullCap) else doE is_final <- without_preemption $ is_final_cap cap;
(remainder, cleanup_info) <- without_preemption $ finalise_cap cap is_final;
if cap_removeable remainder slot then returnOk (True, cleanup_info) else if cap_cyclic_zombie remainder slot \<and> \<not> exposed then doE without_preemption $ set_cap remainder slot;
returnOk (False, NullCap)
odE else doE without_preemption $ set_cap remainder slot;
rec_del (ReduceZombieCall remainder slot exposed);
preemption_point;
rec_del (FinaliseSlotCall slot exposed)
odE
odE
odE)
 2. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'3 s proof (prove)
goal (10 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b s''c. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (rvb, s''b) \<in> fst (finalise_cap rv rva s''a); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed; ((), s''c) \<in> fst (set_cap (fst rvb) slot s''b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'223 rv s'' rva s''a rvb s''b ()\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rv s. emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot)\<rbrace>, -
 2. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (rvb, s''b) \<in> fst (finalise_cap rv rva s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> spec_reads_respects_f s''b aag l (?P'60 rv s'' rva s''a rvb) (without_preemption $ set_cap (fst rvb) slot)
 3. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (rvb, s''b) \<in> fst (finalise_cap rv rva s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?P''61 rv s'' rva s''a rvb\<rbrace> without_preemption $ set_cap (fst rvb) slot \<lbrace>\<lambda>a aa. (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) aa \<and> (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) aa \<and> only_timer_irq_inv (?irq143 rv s'' rva s''a rvb s''b a) st' aa \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and pas_refined aag and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) aa \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and pas_refined aag and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) aa \<and> only_timer_irq_inv irq st' aa \<and> (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) aa \<and> valid_list aa \<and> (valid_sched and simple_sched_action) aa \<and> simple_sched_action aa \<and> (pas_refined aag and einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>y. is_subject aag (fst (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)))) and (\<lambda>y. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl x \<Rightarrow> \<forall>x\<in>obj_refs_ac cap. is_subject aag x | _ \<Rightarrow> True)) aa \<and> ?P'223 rv s'' rva s''a rvb s''b a aa\<rbrace>, -
 4. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> spec_reads_respects_f s''a aag l (?P'19 rv s'' rva) (without_preemption $ finalise_cap rv rva)
 5. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P''20 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (silc_inv aag (?st47 rv s'' rva s''a rvb) and (\<lambda>s. \<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>lslot. lslot \<in> slots_holding_overlapping_caps (fst rvb) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel)) and K (is_subject aag (fst slot))) s \<and> True) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?P'60 rv s'' rva s''a rvb s \<and> ?P''61 rv s'' rva s''a rvb s))\<rbrace>, -
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 7. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ?P'19 rv s'' rva s \<and> ?P''20 rv s'' rva s\<rbrace>, -
 8. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 9. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 10. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (11 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b s''c. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (rvb, s''b) \<in> fst (finalise_cap rv rva s''a); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed; ((), s''c) \<in> fst (set_cap (fst rvb) slot s''b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'223 rv s'' rva s''a rvb s''b ()\<rbrace> rec_del (ReduceZombieCall (fst rvb) slot exposed) \<lbrace>\<lambda>rv s. emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot)\<rbrace>, -
 2. \<And>rv s'' rva s''a rvb s''b s''c rvc s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (rvb, s''b) \<in> fst (finalise_cap rv rva s''a); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed; ((), s''c) \<in> fst (set_cap (fst rvb) slot s''b); emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot)\<rbrakk> \<Longrightarrow> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot)
 3. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (rvb, s''b) \<in> fst (finalise_cap rv rva s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> spec_reads_respects_f s''b aag l (?P'60 rv s'' rva s''a rvb) (without_preemption $ set_cap (fst rvb) slot)
 4. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (rvb, s''b) \<in> fst (finalise_cap rv rva s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?P''61 rv s'' rva s''a rvb\<rbrace> without_preemption $ set_cap (fst rvb) slot \<lbrace>\<lambda>a aa. (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) aa \<and> (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) aa \<and> only_timer_irq_inv (?irq143 rv s'' rva s''a rvb s''b a) st' aa \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and pas_refined aag and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) aa \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and pas_refined aag and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) aa \<and> only_timer_irq_inv irq st' aa \<and> (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) aa \<and> valid_list aa \<and> (valid_sched and simple_sched_action) aa \<and> simple_sched_action aa \<and> (pas_refined aag and einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>y. is_subject aag (fst (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)))) and (\<lambda>y. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl x \<Rightarrow> \<forall>x\<in>obj_refs_ac cap. is_subject aag x | _ \<Rightarrow> True)) aa \<and> ?P'223 rv s'' rva s''a rvb s''b a aa\<rbrace>, -
 5. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> spec_reads_respects_f s''a aag l (?P'19 rv s'' rva) (without_preemption $ finalise_cap rv rva)
 6. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P''20 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (silc_inv aag (?st47 rv s'' rva s''a rvb) and (\<lambda>s. \<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>lslot. lslot \<in> slots_holding_overlapping_caps (fst rvb) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel)) and K (is_subject aag (fst slot))) s \<and> True) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?P'60 rv s'' rva s''a rvb s \<and> ?P''61 rv s'' rva s''a rvb s))\<rbrace>, -
 7. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 8. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ?P'19 rv s'' rva s \<and> ?P''20 rv s'' rva s\<rbrace>, -
 9. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 10. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b s''c rvc s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (rvb, s''b) \<in> fst (finalise_cap rv rva s''a); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed; ((), s''c) \<in> fst (set_cap (fst rvb) slot s''b); emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot)\<rbrakk> \<Longrightarrow> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot)
 2. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (rvb, s''b) \<in> fst (finalise_cap rv rva s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> spec_reads_respects_f s''b aag l (?P'60 rv s'' rva s''a rvb) (without_preemption $ set_cap (fst rvb) slot)
 3. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (rvb, s''b) \<in> fst (finalise_cap rv rva s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?P''61 rv s'' rva s''a rvb\<rbrace> without_preemption $ set_cap (fst rvb) slot \<lbrace>\<lambda>a aa. (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) aa \<and> (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) aa \<and> only_timer_irq_inv (?irq143 rv s'' rva s''a rvb s''b a) st' aa \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and pas_refined aag and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) aa \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and pas_refined aag and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) aa \<and> only_timer_irq_inv irq st' aa \<and> (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) aa \<and> valid_list aa \<and> (valid_sched and simple_sched_action) aa \<and> simple_sched_action aa \<and> (pas_refined aag and einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>y. is_subject aag (fst (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)))) and (\<lambda>y. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl x \<Rightarrow> \<forall>x\<in>obj_refs_ac cap. is_subject aag x | _ \<Rightarrow> True)) aa \<and> (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) aa \<and> (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable slot and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and K (\<not> cap_removeable (fst rvb) slot) and (\<lambda>s. \<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s)) aa \<and> is_subject aag (fst slot)\<rbrace>, -
 4. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> spec_reads_respects_f s''a aag l (?P'19 rv s'' rva) (without_preemption $ finalise_cap rv rva)
 5. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P''20 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (silc_inv aag (?st47 rv s'' rva s''a rvb) and (\<lambda>s. \<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>lslot. lslot \<in> slots_holding_overlapping_caps (fst rvb) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel)) and K (is_subject aag (fst slot))) s \<and> True) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?P'60 rv s'' rva s''a rvb s \<and> ?P''61 rv s'' rva s''a rvb s))\<rbrace>, -
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 7. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ?P'19 rv s'' rva s \<and> ?P''20 rv s'' rva s\<rbrace>, -
 8. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 9. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 10. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (9 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (rvb, s''b) \<in> fst (finalise_cap rv rva s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> spec_reads_respects_f s''b aag l (?P'60 rv s'' rva s''a rvb) (without_preemption $ set_cap (fst rvb) slot)
 2. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (rvb, s''b) \<in> fst (finalise_cap rv rva s''a); \<not> cap_removeable (fst rvb) slot; \<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed)\<rbrakk> \<Longrightarrow> \<lbrace>?P''61 rv s'' rva s''a rvb\<rbrace> without_preemption $ set_cap (fst rvb) slot \<lbrace>\<lambda>a aa. (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) aa \<and> (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) aa \<and> only_timer_irq_inv (?irq143 rv s'' rva s''a rvb s''b a) st' aa \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and pas_refined aag and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) aa \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and pas_refined aag and K (case ReduceZombieCall (fst rvb) slot exposed of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) aa \<and> only_timer_irq_inv irq st' aa \<and> (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) aa \<and> valid_list aa \<and> (valid_sched and simple_sched_action) aa \<and> simple_sched_action aa \<and> (pas_refined aag and einvs and simple_sched_action and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and (\<lambda>y. is_subject aag (fst (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)))) and (\<lambda>y. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl x \<Rightarrow> \<forall>x\<in>obj_refs_ac cap. is_subject aag x | _ \<Rightarrow> True)) aa \<and> (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (fst rvb) slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) s) and emptyable (slot_rdcall (ReduceZombieCall (fst rvb) slot exposed)) and (\<lambda>s. case ReduceZombieCall (fst rvb) slot exposed of ReduceZombieCall cap sl ex \<Rightarrow> \<not> cap_removeable cap sl \<and> (\<forall>t\<in>obj_refs cap. halted_if_tcb t s) | _ \<Rightarrow> True)) aa \<and> (invs and valid_rec_del_call (ReduceZombieCall (fst rvb) slot exposed) and emptyable slot and (\<lambda>s. \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) and K (\<not> cap_removeable (fst rvb) slot) and (\<lambda>s. \<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s)) aa \<and> is_subject aag (fst slot)\<rbrace>, -
 3. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> spec_reads_respects_f s''a aag l (?P'19 rv s'' rva) (without_preemption $ finalise_cap rv rva)
 4. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P''20 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (silc_inv aag (?st47 rv s'' rva s''a rvb) and (\<lambda>s. \<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>lslot. lslot \<in> slots_holding_overlapping_caps (fst rvb) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel)) and K (is_subject aag (fst slot))) s \<and> True) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> ?P'60 rv s'' rva s''a rvb s \<and> ?P''61 rv s'' rva s''a rvb s))\<rbrace>, -
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ?P'19 rv s'' rva s \<and> ?P''20 rv s'' rva s\<rbrace>, -
 7. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 8. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 9. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (8 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (rvb, s''b) \<in> fst (finalise_cap rv rva s''a); \<not> cap_removeable (fst rvb) slot; cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> \<lbrace>?P'274 rv s'' rva s''a rvb\<rbrace> set_cap (fst rvb) slot \<lbrace>\<lambda>rvc s. only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (fst rvb)) slot s \<and> is_final_cap' (fst rvb) s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> invs s \<and> cte_wp_at ((=) (fst rvb)) slot s \<and> is_final_cap' (fst rvb) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> emptyable slot s \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s) \<and> only_timer_irq_inv (?irq143 rv s'' rva s''a rvb s''b ()) st' s \<and> silc_inv aag st s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (fst rvb)) slot s \<and> is_final_cap' (fst rvb) s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> pas_refined aag s \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> silc_inv aag st s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (fst rvb)) slot s \<and> is_final_cap' (fst rvb) s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> pas_refined aag s \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> cte_wp_at ((=) (fst rvb)) slot s \<and> is_final_cap' (fst rvb) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> emptyable slot s \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at ((=) (fst rvb)) slot s \<and> is_final_cap' (fst rvb) s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>obj_refs_ac (fst rvb). is_subject aag x) \<and> invs s \<and> cte_wp_at ((=) (fst rvb)) slot s \<and> is_final_cap' (fst rvb) s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> emptyable slot s \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s) \<and> invs s \<and> cte_wp_at ((=) (fst rvb)) slot s \<and> is_final_cap' (fst rvb) s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> (\<forall>t\<in>obj_refs (fst rvb). halted_if_tcb t s) \<and> is_subject aag (fst slot)\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> spec_reads_respects_f s''a aag l (?P'19 rv s'' rva) (without_preemption $ finalise_cap rv rva)
 3. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap; (Inr rva, s''a) \<in> fst ((without_preemption $ is_final_cap rv) s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P''20 rv s'' rva\<rbrace> without_preemption $ finalise_cap rv rva \<lbrace>\<lambda>rvb s. (cap_removeable (fst rvb) slot \<longrightarrow> True) \<and> (\<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> (silc_inv aag (?st47 rv s'' rva s''a rvb) and (\<lambda>s. \<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>lslot. lslot \<in> slots_holding_overlapping_caps (fst rvb) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel)) and K (is_subject aag (fst slot))) s \<and> True) \<and> (\<not> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed) \<longrightarrow> (silc_inv aag st and (\<lambda>s. \<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>lslot. lslot \<in> slots_holding_overlapping_caps (fst rvb) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel)) and K (is_subject aag (fst slot))) s \<and> ((\<lambda>s. \<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>lslot. lslot \<in> slots_holding_overlapping_caps (fst rvb) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel)) and silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel)) s \<and> ?P'274 rv s'' rva s''a rvb s))\<rbrace>, -
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. ?P'19 rv s'' rva s \<and> ?P''20 rv s'' rva s\<rbrace>, -
 6. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 7. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 8. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P''20 rv s'' rva\<rbrace> finalise_cap rv rva \<lbrace>\<lambda>rvb s. \<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a rvb) s \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> is_subject aag (fst slot)) \<and> ((cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed) \<longrightarrow> silc_inv aag st s \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> is_subject aag (fst slot) \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> silc_inv aag st s \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False (fst rvb) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a rvb ()) st' s \<and> domain_sep_inv_cap False (fst rvb) \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> silc_inv aag st s \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> silc_inv aag st s \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False (fst rvb) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>obj_refs_ac (fst rvb). is_subject aag x) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> is_subject aag (fst slot))\<rbrace>
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ?P''20 rv s'' rva s\<rbrace>, -
 4. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 5. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 6. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P''20 rv s'' rva\<rbrace> finalise_cap rv rva \<lbrace>?Q862 rv s'' rva s''a\<rbrace>
 2. \<And>rv s'' rva s''a rvb s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); ?Q862 rv s'' rva s''a rvb s\<rbrakk> \<Longrightarrow> \<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a rvb) s \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> is_subject aag (fst slot)) \<and> ((cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed) \<longrightarrow> silc_inv aag st s \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> is_subject aag (fst slot) \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> silc_inv aag st s \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False (fst rvb) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a rvb ()) st' s \<and> domain_sep_inv_cap False (fst rvb) \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> silc_inv aag st s \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> silc_inv aag st s \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False (fst rvb) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>obj_refs_ac (fst rvb). is_subject aag x) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> is_subject aag (fst slot))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ?P''20 rv s'' rva s\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (8 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P867 rv s'' rva\<rbrace> finalise_cap rv rva \<lbrace>\<lambda>fin s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> (\<not> cap_points_to_label aag (fst fin) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>lslot. lslot \<in> slots_holding_overlapping_caps (fst fin) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel)) \<and> einvs s \<and> replaceable s slot (fst fin) rv \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> fst fin \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (\<forall>t\<in>obj_refs_ac (fst fin). halted_if_tcb t s) \<and> pas_refined aag s \<and> emptyable slot s \<and> simple_sched_action s \<and> pas_cap_cur_auth aag (fst fin) \<and> is_subject aag (fst slot) \<and> (case fst fin of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst fin)) | _ \<Rightarrow> True) \<and> (is_zombie (fst fin) \<or> fst fin = NullCap) \<and> (is_zombie (fst fin) \<or> fst fin = NullCap)\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P'868 rv s'' rva\<rbrace> finalise_cap rv rva \<lbrace>?Q'865 rv s'' rva s''a\<rbrace>
 3. \<And>rv s'' rva s''a rvb s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>lslot. lslot \<in> slots_holding_overlapping_caps (fst rvb) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel)) \<and> einvs s \<and> replaceable s slot (fst rvb) rv \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> fst rvb \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (\<forall>t\<in>obj_refs_ac (fst rvb). halted_if_tcb t s) \<and> pas_refined aag s \<and> emptyable slot s \<and> simple_sched_action s \<and> pas_cap_cur_auth aag (fst rvb) \<and> is_subject aag (fst slot) \<and> (case fst rvb of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst rvb)) | _ \<Rightarrow> True) \<and> (is_zombie (fst rvb) \<or> fst rvb = NullCap) \<and> (is_zombie (fst rvb) \<or> fst rvb = NullCap)) \<and> ?Q'865 rv s'' rva s''a rvb s\<rbrakk> \<Longrightarrow> \<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a rvb) s \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> is_subject aag (fst slot)) \<and> ((cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed) \<longrightarrow> silc_inv aag st s \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> is_subject aag (fst slot) \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> silc_inv aag st s \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False (fst rvb) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a rvb ()) st' s \<and> domain_sep_inv_cap False (fst rvb) \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> silc_inv aag st s \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> silc_inv aag st s \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False (fst rvb) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>obj_refs_ac (fst rvb). is_subject aag x) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> is_subject aag (fst slot))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ?P867 rv s'' rva s \<and> ?P'868 rv s'' rva s\<rbrace>, -
 6. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 7. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 8. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P'868 rv s'' rva\<rbrace> finalise_cap rv rva \<lbrace>?Q'865 rv s'' rva s''a\<rbrace>
 2. \<And>rv s'' rva s''a rvb s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>lslot. lslot \<in> slots_holding_overlapping_caps (fst rvb) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel)) \<and> einvs s \<and> replaceable s slot (fst rvb) rv \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> fst rvb \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (\<forall>t\<in>obj_refs_ac (fst rvb). halted_if_tcb t s) \<and> pas_refined aag s \<and> emptyable slot s \<and> simple_sched_action s \<and> pas_cap_cur_auth aag (fst rvb) \<and> is_subject aag (fst slot) \<and> (case fst rvb of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst rvb)) | _ \<Rightarrow> True) \<and> (is_zombie (fst rvb) \<or> fst rvb = NullCap) \<and> (is_zombie (fst rvb) \<or> fst rvb = NullCap)) \<and> ?Q'865 rv s'' rva s''a rvb s\<rbrakk> \<Longrightarrow> \<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a rvb) s \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> is_subject aag (fst slot)) \<and> ((cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed) \<longrightarrow> silc_inv aag st s \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> is_subject aag (fst slot) \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> silc_inv aag st s \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False (fst rvb) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a rvb ()) st' s \<and> domain_sep_inv_cap False (fst rvb) \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> silc_inv aag st s \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> silc_inv aag st s \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False (fst rvb) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>obj_refs_ac (fst rvb). is_subject aag x) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> is_subject aag (fst slot))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> ?P'868 rv s'' rva s\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a rvb s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); (silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>lslot. lslot \<in> slots_holding_overlapping_caps (fst rvb) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel)) \<and> einvs s \<and> replaceable s slot (fst rvb) rv \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> fst rvb \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (\<forall>t\<in>obj_refs_ac (fst rvb). halted_if_tcb t s) \<and> pas_refined aag s \<and> emptyable slot s \<and> simple_sched_action s \<and> pas_cap_cur_auth aag (fst rvb) \<and> is_subject aag (fst slot) \<and> (case fst rvb of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst rvb)) | _ \<Rightarrow> True) \<and> (is_zombie (fst rvb) \<or> fst rvb = NullCap) \<and> (is_zombie (fst rvb) \<or> fst rvb = NullCap)) \<and> (fst rvb = NullCap \<and> snd rvb = (if rva then cap_cleanup_opt rv else NullCap) \<and> (snd rvb \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie (fst rvb) \<and> is_final_cap' rv s \<and> is_final_cap' (fst rvb) s \<and> snd rvb = NullCap \<and> appropriate_cte_cap (fst rvb) = appropriate_cte_cap rv \<and> cte_refs (fst rvb) = cte_refs rv \<and> gen_obj_refs (fst rvb) = gen_obj_refs rv \<and> obj_size (fst rvb) = obj_size rv \<and> fst_cte_ptrs (fst rvb) = fst_cte_ptrs rv \<and> vs_cap_ref rv = None)\<rbrakk> \<Longrightarrow> \<not> cap_removeable (fst rvb) slot \<longrightarrow> (cap_cyclic_zombie (fst rvb) slot \<and> \<not> exposed \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a rvb) s \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> is_subject aag (fst slot)) \<and> ((cap_cyclic_zombie (fst rvb) slot \<longrightarrow> exposed) \<longrightarrow> silc_inv aag st s \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> is_subject aag (fst slot) \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> silc_inv aag st s \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False (fst rvb) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a rvb ()) st' s \<and> domain_sep_inv_cap False (fst rvb) \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> silc_inv aag st s \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> (\<not> cap_points_to_label aag (fst rvb) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (fst rvb) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> silc_inv aag st s \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of (fst rvb)) \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False (fst rvb) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> cte_wp_at (\<lambda>c. \<not> is_transferable_cap c) slot s \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (fst rvb) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>obj_refs_ac (fst rvb). is_subject aag x) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> invs s \<and> cte_wp_at (replaceable s slot (fst rvb)) slot s \<and> fst rvb \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap (fst rvb)) slot s \<and> s \<turnstile> fst rvb \<and> cte_wp_at (\<lambda>_. True) slot s \<and> is_final_cap' (fst rvb) s \<and> cte_wp_at (\<lambda>c. obj_refs (fst rvb) \<inter> obj_refs c = {} \<longrightarrow> cap_irqs (fst rvb) \<inter> cap_irqs c \<noteq> {}) slot s \<and> is_zombie (fst rvb) \<and> emptyable slot s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<not> exposed \<longrightarrow> cte_wp_at (\<lambda>cap'. slot \<in> cte_refs cap' (interrupt_irq_node s) \<and> cap_irqs cap' = {} \<longrightarrow> slot \<in> cte_refs (fst rvb) (interrupt_irq_node s) \<and> cap_irqs (fst rvb) = {}) slot s \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs (fst rvb). halted_if_tcb x s) \<and> is_subject aag (fst slot))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 4. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 5. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 6. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; is_zombie a \<or> a = NullCap; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a (a, b)) s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 4. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 5. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 6. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; is_zombie a\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a (a, b)) s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a (a, b)) s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a s x111 x112 x113. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie x111 x112 x113) (pasSubject aag) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie x111 x112 x113) s) \<and> pasObjectAbs aag a = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie x111 x112 x113) rv; s \<turnstile> Zombie x111 x112 x113; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie x111 x112 x113); is_subject aag (fst slot); is_subject aag x111; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < x113; x113 = Suc 0 \<longrightarrow> (x111, replicate (zombie_cte_bits x112) False) \<noteq> slot; is_final_cap' (Zombie x111 x112 x113) s; appropriate_cte_cap (Zombie x111 x112 x113) = appropriate_cte_cap rv; cte_refs (Zombie x111 x112 x113) = cte_refs rv; {x111} = obj_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case x112 of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie x111 x112 x113) = fst_cte_ptrs rv; vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie (Zombie x111 x112 x113) slot \<and> \<not> exposed \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a (Zombie x111 x112 x113, NullCap)) s) \<and> ((cap_cyclic_zombie (Zombie x111 x112 x113) slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False (Zombie x111 x112 x113) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> obj_refs rv \<noteq> {} \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> obj_refs rv \<noteq> {} \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (Zombie x111 x112 x113, NullCap) ()) st' s \<and> domain_sep_inv_cap False (Zombie x111 x112 x113) \<and> pasSubject aag \<noteq> SilcLabel \<and> obj_refs rv \<noteq> {} \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> pasSubject aag \<noteq> SilcLabel \<and> obj_refs rv \<noteq> {} \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> domain_sep_inv_cap False (Zombie x111 x112 x113) \<and> obj_refs rv \<noteq> {} \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> obj_refs rv \<noteq> {} \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs rv. is_subject aag x) \<and> obj_refs rv \<noteq> {} \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> obj_refs rv \<noteq> {} \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s))
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a (a, b)) s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a s x111 x112 x113. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie x111 x112 x113) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie x111 x112 x113) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie x111 x112 x113) rv; s \<turnstile> Zombie x111 x112 x113; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie x111 x112 x113); is_subject aag (fst slot); is_subject aag x111; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < x113; x113 = Suc 0 \<longrightarrow> (x111, replicate (zombie_cte_bits x112) False) \<noteq> slot; is_final_cap' (Zombie x111 x112 x113) s; appropriate_cte_cap (Zombie x111 x112 x113) = appropriate_cte_cap rv; cte_refs (Zombie x111 x112 x113) = cte_refs rv; {x111} = obj_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case x112 of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie x111 x112 x113) = fst_cte_ptrs rv; vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> (\<not> exposed \<and> cap_cyclic_zombie (Zombie x111 x112 x113) slot \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a (Zombie x111 x112 x113, NullCap)) s) \<and> ((cap_cyclic_zombie (Zombie x111 x112 x113) slot \<longrightarrow> exposed) \<longrightarrow> valid_arch_state s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> \<not> is_transferable_cap rv \<and> obj_refs rv \<noteq> {} \<and> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False (Zombie x111 x112 x113) \<and> (\<forall>x\<in>obj_refs rv. is_subject aag x) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (Zombie x111 x112 x113, NullCap) ()) st' s)
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a (a, b)) s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a s word option nat. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {word} = obj_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None\<rbrakk> \<Longrightarrow> (\<not> exposed \<and> cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a (Zombie word option nat, NullCap)) s) \<and> ((cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> exposed) \<longrightarrow> valid_arch_state s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> \<not> is_transferable_cap rv \<and> obj_refs rv \<noteq> {} \<and> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False (Zombie word option nat) \<and> (\<forall>x\<in>obj_refs rv. is_subject aag x) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (Zombie word option nat, NullCap) ()) st' s)
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a (a, b)) s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a s word option nat. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs rv. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}\<rbrakk> \<Longrightarrow> (\<not> exposed \<and> cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a (Zombie word option nat, NullCap)) s) \<and> ((cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> exposed) \<longrightarrow> valid_arch_state s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> \<not> is_transferable_cap rv \<and> obj_refs rv \<noteq> {} \<and> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False (Zombie word option nat) \<and> (\<forall>x\<in>obj_refs rv. is_subject aag x) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (Zombie word option nat, NullCap) ()) st' s)
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a (a, b)) s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a s word option nat. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}\<rbrakk> \<Longrightarrow> (\<not> exposed \<and> cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a (Zombie word option nat, NullCap)) s) \<and> ((cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> exposed) \<longrightarrow> \<not> is_transferable_cap rv \<and> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False (Zombie word option nat) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (Zombie word option nat, NullCap) ()) st' s)
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag (?st47 rv s'' rva s''a (a, b)) s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a s word option nat. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> exposed) \<longrightarrow> \<not> is_transferable_cap rv \<and> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False (Zombie word option nat) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (Zombie word option nat, NullCap) ()) st' s
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag st s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (8 subgoals):
 1. \<And>rv s'' rva s''a s word option nat. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}; cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> \<not> is_transferable_cap rv
 2. \<And>rv s'' rva s''a s word option nat. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}; cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False (Zombie word option nat) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (Zombie word option nat, NullCap) ()) st' s
 3. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag st s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 6. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 7. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 8. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a s word option nat. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}; cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False (Zombie word option nat) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (Zombie word option nat, NullCap) ()) st' s
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag st s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a s word option nat. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}; cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False (Zombie word option nat) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (Zombie word option nat, NullCap) ()) st' s
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag st s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (8 subgoals):
 1. \<And>rv s'' rva s''a s word option nat. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}; cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> pasSubject aag \<noteq> SilcLabel
 2. \<And>rv s'' rva s''a s word option nat. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}; cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> domain_sep_inv_cap False (Zombie word option nat) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (Zombie word option nat, NullCap) ()) st' s
 3. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag st s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 6. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 7. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 8. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a s word option nat. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}; cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> domain_sep_inv_cap False (Zombie word option nat) \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (Zombie word option nat, NullCap) ()) st' s
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag st s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (8 subgoals):
 1. \<And>rv s'' rva s''a s word option nat. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}; cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> domain_sep_inv_cap False (Zombie word option nat)
 2. \<And>rv s'' rva s''a s word option nat. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}; cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (Zombie word option nat, NullCap) ()) st' s
 3. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag st s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 6. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 7. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 8. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a s word option nat. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}; cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (Zombie word option nat, NullCap) ()) st' s
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag st s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv (?irq427 rv s'' rva s''a (a, b) ()) st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a s word option nat. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}; cap_cyclic_zombie (Zombie word option nat) slot \<longrightarrow> exposed\<rbrakk> \<Longrightarrow> \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag st s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a s word option nat a b. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}; cte_wp_at (\<lambda>c. appropriate_cte_cap rv c \<and> slot \<in> cte_refs c (interrupt_irq_node s)) (a, b) s; \<not> exposed; \<not> cap_cyclic_zombie (Zombie word option nat) slot\<rbrakk> \<Longrightarrow> \<exists>a b. cte_wp_at (\<lambda>c. cap_irqs c = {} \<and> slot \<in> cte_refs c (interrupt_irq_node s)) (a, b) s
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag st s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a s word option nat a b. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}; cte_wp_at (\<lambda>c. appropriate_cte_cap rv c \<and> slot \<in> cte_refs c (interrupt_irq_node s)) (a, b) s; \<not> exposed; \<not> cap_cyclic_zombie (Zombie word option nat) slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. cap_irqs c = {} \<and> slot \<in> cte_refs c (interrupt_irq_node s)) (a, b) s
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag st s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a s word option nat a b cap. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; appropriate_cte_cap (Zombie word option nat) = appropriate_cte_cap rv; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}; \<not> exposed; \<not> cap_cyclic_zombie (Zombie word option nat) slot; fst (get_cap (a, b) s) = {(cap, s)}; case rv of NullCap \<Rightarrow> True | NotificationCap x xa xb \<Rightarrow> True | _ \<Rightarrow> cap_irqs cap = {}; slot \<in> cte_refs cap (interrupt_irq_node s)\<rbrakk> \<Longrightarrow> cap_irqs cap = {}
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag st s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a s word option nat a b cap. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag (Zombie word option nat) (pasSubject aag) \<longrightarrow> (\<exists>a. pasObjectAbs aag a = SilcLabel \<and> (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie word option nat) s)); invs s; valid_list s; valid_sched s; replaceable s slot (Zombie word option nat) rv; s \<turnstile> Zombie word option nat; halted_if_tcb word s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag (Zombie word option nat); is_subject aag (fst slot); is_subject aag word; fst (get_cap slot s) = {(rv, s)}; is_final_cap' rv s; 0 < nat; nat = Suc 0 \<longrightarrow> (word, replicate (zombie_cte_bits option) False) \<noteq> slot; is_final_cap' (Zombie word option nat) s; cte_refs (Zombie word option nat) = cte_refs rv; {} = cap_irqs rv; {} = arch_gen_refs rv; (case option of None \<Rightarrow> 0x200 | Some n \<Rightarrow> 2 ^ (cte_level_bits + n)) = obj_size rv; fst_cte_ptrs (Zombie word option nat) = fst_cte_ptrs rv; vs_cap_ref rv = None; obj_refs rv = {word}; \<not> exposed; \<not> cap_cyclic_zombie (Zombie word option nat) slot; fst (get_cap (a, b) s) = {(cap, s)}; case rv of NullCap \<Rightarrow> True | NotificationCap x xa xb \<Rightarrow> True | _ \<Rightarrow> cap_irqs cap = {}; slot \<in> cte_refs cap (interrupt_irq_node s); appropriate_cte_cap (Zombie word option nat) cap = appropriate_cte_cap rv cap\<rbrakk> \<Longrightarrow> cap_irqs cap = {}
 2. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag st s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 5. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 6. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 7. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a a b s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; (rva, s''a) \<in> fst (is_final_cap rv s''); silc_inv aag st s; only_timer_irq_inv irq st' s; \<not> cap_points_to_label aag a (pasSubject aag) \<longrightarrow> (\<exists>aa. (\<exists>b. (aa, b) \<in> slots_holding_overlapping_caps a s) \<and> pasObjectAbs aag aa = SilcLabel); invs s; valid_list s; valid_sched s; replaceable s slot a rv; caps_of_state s slot = Some rv; s \<turnstile> a; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; \<forall>t\<in>obj_refs_ac a. halted_if_tcb t s; pas_refined aag s; emptyable slot s; simple_sched_action s; pas_cap_cur_auth aag a; is_subject aag (fst slot); case a of Zombie x xa xb \<Rightarrow> is_subject aag (obj_ref_of (fst (a, b))) | _ \<Rightarrow> True; a = NullCap \<and> b = (if rva then cap_cleanup_opt rv else NullCap) \<and> (b \<noteq> NullCap \<longrightarrow> is_final_cap' rv s) \<or> is_zombie a \<and> is_final_cap' rv s \<and> is_final_cap' a s \<and> b = NullCap \<and> appropriate_cte_cap a = appropriate_cte_cap rv \<and> cte_refs a = cte_refs rv \<and> gen_obj_refs a = gen_obj_refs rv \<and> obj_size a = obj_size rv \<and> fst_cte_ptrs a = fst_cte_ptrs rv \<and> vs_cap_ref rv = None; \<not> cap_removeable a slot; a = NullCap\<rbrakk> \<Longrightarrow> (cap_cyclic_zombie a slot \<and> \<not> exposed \<longrightarrow> silc_inv aag st s) \<and> ((cap_cyclic_zombie a slot \<longrightarrow> exposed) \<longrightarrow> pasSubject aag \<noteq> SilcLabel \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> is_subject aag (obj_ref_of a) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> only_timer_irq_inv irq st' s \<and> domain_sep_inv_cap False a \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> pasSubject aag \<noteq> SilcLabel \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> is_subject aag (obj_ref_of a) \<and> domain_sep_inv_cap False a \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> \<not> is_transferable_cap rv \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs_ac a. is_subject aag x) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s) \<and> a \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap a) slot s \<and> is_final_cap' a s \<and> (obj_refs a \<inter> obj_refs rv = {} \<longrightarrow> cap_irqs a \<inter> cap_irqs rv \<noteq> {}) \<and> is_zombie a \<and> (\<not> exposed \<longrightarrow> (slot \<in> cte_refs rv (interrupt_irq_node s) \<and> cap_irqs rv = {} \<longrightarrow> slot \<in> cte_refs a (interrupt_irq_node s) \<and> cap_irqs a = {}) \<and> ex_cte_cap_wp_to (\<lambda>a. cap_irqs a = {}) slot s) \<and> (\<forall>x\<in>obj_refs a. halted_if_tcb x s))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 4. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 5. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 6. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (5 subgoals):
 1. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> spec_reads_respects_f s'' aag l (?P'16 rv) (without_preemption $ is_final_cap rv)
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst (liftE (get_cap slot) s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P''17 rv\<rbrace> without_preemption $ is_final_cap rv \<lbrace>\<lambda>rva s. (silc_inv aag (?st848 rv s'' rva) and pas_refined aag and invs and cte_wp_at ((=) rv) (?slot850 rv s'' rva) and K (pas_cap_cur_auth aag rv) and K (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True))) s \<and> ((silc_inv aag st and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> only_timer_irq_inv irq st' s \<and> (silc_inv aag (?st891 rv s'' rva) and pspace_aligned and valid_vspace_objs and valid_arch_state and valid_mdb and cte_wp_at ((=) rv) slot and pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> (invs and cte_wp_at ((=) rv) (?slot905 rv s'' rva)) s \<and> valid_list s \<and> (valid_sched and simple_sched_action) s \<and> (s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s)) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> (invs and valid_cap rv and (\<lambda>s. rva = is_final_cap' rv s) and cte_wp_at ((=) rv) (?slot950 rv s'' rva)) s \<and> (pas_refined aag and invs and valid_cap rv and K (pas_cap_cur_auth aag rv)) s \<and> (emptyable slot and invs) s \<and> simple_sched_action s \<and> (pas_refined aag and K (pas_cap_cur_auth aag rv)) s \<and> is_subject aag (fst slot) \<and> K (is_cnode_cap rv \<or> is_thread_cap rv \<or> is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) s \<and> True \<and> True) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>, -
 3. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 4. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> ?P'16 rv s \<and> ?P''17 rv s)\<rbrace>, -
 5. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (4 subgoals):
 1. \<And>rv s''. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P'1253 rv\<rbrace> is_final_cap rv \<lbrace>\<lambda>rva s. (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True)) \<and> silc_inv aag st s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag (?st891 rv s'' rva) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> cte_wp_at ((=) rv) (?slot905 rv s'' rva) s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> invs s \<and> s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> cte_wp_at ((=) rv) (?slot950 rv s'' rva) s \<and> pas_refined aag s \<and> invs s \<and> s \<turnstile> rv \<and> pas_cap_cur_auth aag rv \<and> emptyable slot s \<and> invs s \<and> simple_sched_action s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> is_subject aag (fst slot) \<and> (is_cnode_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_thread_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)\<rbrace>
 2. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 3. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> (silc_inv aag (?st1208 rv) and (\<lambda>s. cte_wp_at ((=) rv) (?slot1212 rv) s \<and> aag_can_read aag (fst (?slot1212 rv)) \<and> pasObjectAbs aag (fst (?slot1212 rv)) \<noteq> SilcLabel)) s \<and> silc_inv aag (?st1237 rv) s \<and> pas_refined aag s \<and> invs s \<and> cte_wp_at ((=) rv) (?slot1250 rv) s \<and> pas_cap_cur_auth aag rv \<and> ?P'1253 rv s)\<rbrace>, -
 4. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (5 subgoals):
 1. \<And>rv s''. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P'1253 rv\<rbrace> is_final_cap rv \<lbrace>\<lambda>rva s. rva = is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s\<rbrace>
 2. \<And>rv s'' rva s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; rva = is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s\<rbrakk> \<Longrightarrow> (rva \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True)) \<and> silc_inv aag st s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag (?st891 rv s'' rva) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> cte_wp_at ((=) rv) (?slot905 rv s'' rva) s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) slot s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s) \<and> cte_wp_at ((=) rv) slot s \<and> s \<turnstile> rv \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s \<and> invs s \<and> s \<turnstile> rv \<and> rva = is_final_cap' rv s \<and> cte_wp_at ((=) rv) (?slot950 rv s'' rva) s \<and> pas_refined aag s \<and> invs s \<and> s \<turnstile> rv \<and> pas_cap_cur_auth aag rv \<and> emptyable slot s \<and> invs s \<and> simple_sched_action s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> is_subject aag (fst slot) \<and> (is_cnode_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_thread_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (rva \<longrightarrow> is_final_cap' rv s \<and> cte_wp_at ((=) rv) slot s)
 3. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 4. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> (silc_inv aag (?st1208 rv) and (\<lambda>s. cte_wp_at ((=) rv) (?slot1212 rv) s \<and> aag_can_read aag (fst (?slot1212 rv)) \<and> pasObjectAbs aag (fst (?slot1212 rv)) \<noteq> SilcLabel)) s \<and> silc_inv aag (?st1237 rv) s \<and> pas_refined aag s \<and> invs s \<and> cte_wp_at ((=) rv) (?slot1250 rv) s \<and> pas_cap_cur_auth aag rv \<and> ?P'1253 rv s)\<rbrace>, -
 5. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s\<rbrakk> \<Longrightarrow> (is_final_cap' rv s \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True)) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> silc_inv aag (?st891 rv s'' (is_final_cap' rv s)) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) (?slot905 rv s'' (is_final_cap' rv s)) s \<and> valid_mdb s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s) \<and> cte_wp_at ((=) rv) (?slot950 rv s'' (is_final_cap' rv s)) s \<and> (is_cnode_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_thread_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv))
 2. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 3. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> (silc_inv aag (?st1208 rv) and (\<lambda>s. cte_wp_at ((=) rv) (?slot1212 rv) s \<and> aag_can_read aag (fst (?slot1212 rv)) \<and> pasObjectAbs aag (fst (?slot1212 rv)) \<noteq> SilcLabel)) s \<and> silc_inv aag (?st1237 rv) s \<and> pas_refined aag s \<and> invs s \<and> cte_wp_at ((=) rv) (?slot1250 rv) s \<and> pas_cap_cur_auth aag rv \<and> True \<and> cte_wp_at ((=) rv) slot s \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s)\<rbrace>, -
 4. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s\<rbrakk> \<Longrightarrow> (is_final_cap' rv s \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True)) \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> silc_inv aag (?st891 rv s'' (is_final_cap' rv s)) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) (?slot905 rv s'' (is_final_cap' rv s)) s \<and> valid_mdb s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s) \<and> cte_wp_at ((=) rv) (?slot950 rv s'' (is_final_cap' rv s)) s \<and> (is_cnode_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_thread_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv))
 2. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 3. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> (silc_inv aag (?st1208 rv) and (\<lambda>s. cte_wp_at ((=) rv) (?slot1212 rv) s \<and> aag_can_read aag (fst (?slot1212 rv)) \<and> pasObjectAbs aag (fst (?slot1212 rv)) \<noteq> SilcLabel)) s \<and> silc_inv aag (?st1237 rv) s \<and> pas_refined aag s \<and> invs s \<and> cte_wp_at ((=) rv) (?slot1250 rv) s \<and> pas_cap_cur_auth aag rv \<and> True \<and> cte_wp_at ((=) rv) slot s \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s)\<rbrace>, -
 4. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s\<rbrakk> \<Longrightarrow> is_final_cap' rv s \<longrightarrow> (case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True)
 2. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> silc_inv aag (?st891 rv s'' (is_final_cap' rv s)) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) (?slot905 rv s'' (is_final_cap' rv s)) s \<and> valid_mdb s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s) \<and> cte_wp_at ((=) rv) (?slot950 rv s'' (is_final_cap' rv s)) s \<and> (is_cnode_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_thread_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv))
 3. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 4. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> (silc_inv aag (?st1208 rv) and (\<lambda>s. cte_wp_at ((=) rv) (?slot1212 rv) s \<and> aag_can_read aag (fst (?slot1212 rv)) \<and> pasObjectAbs aag (fst (?slot1212 rv)) \<noteq> SilcLabel)) s \<and> silc_inv aag (?st1237 rv) s \<and> pas_refined aag s \<and> invs s \<and> cte_wp_at ((=) rv) (?slot1250 rv) s \<and> pas_cap_cur_auth aag rv \<and> True \<and> cte_wp_at ((=) rv) slot s \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s)\<rbrace>, -
 5. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; is_final_cap' rv s\<rbrakk> \<Longrightarrow> case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True
 2. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> silc_inv aag (?st891 rv s'' (is_final_cap' rv s)) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) (?slot905 rv s'' (is_final_cap' rv s)) s \<and> valid_mdb s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s) \<and> cte_wp_at ((=) rv) (?slot950 rv s'' (is_final_cap' rv s)) s \<and> (is_cnode_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_thread_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv))
 3. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 4. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> (silc_inv aag (?st1208 rv) and (\<lambda>s. cte_wp_at ((=) rv) (?slot1212 rv) s \<and> aag_can_read aag (fst (?slot1212 rv)) \<and> pasObjectAbs aag (fst (?slot1212 rv)) \<noteq> SilcLabel)) s \<and> silc_inv aag (?st1237 rv) s \<and> pas_refined aag s \<and> invs s \<and> cte_wp_at ((=) rv) (?slot1250 rv) s \<and> pas_cap_cur_auth aag rv \<and> True \<and> cte_wp_at ((=) rv) slot s \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s)\<rbrace>, -
 5. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; is_final_cap' rv s; \<forall>cap slot. cte_wp_at ((=) cap) slot s \<and> is_final_cap' cap s \<longrightarrow> intra_label_cap aag slot s \<or> pasObjectAbs aag (fst slot) = SilcLabel\<rbrakk> \<Longrightarrow> case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True
 2. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> silc_inv aag (?st891 rv s'' (is_final_cap' rv s)) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) (?slot905 rv s'' (is_final_cap' rv s)) s \<and> valid_mdb s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s) \<and> cte_wp_at ((=) rv) (?slot950 rv s'' (is_final_cap' rv s)) s \<and> (is_cnode_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_thread_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv))
 3. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 4. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> (silc_inv aag (?st1208 rv) and (\<lambda>s. cte_wp_at ((=) rv) (?slot1212 rv) s \<and> aag_can_read aag (fst (?slot1212 rv)) \<and> pasObjectAbs aag (fst (?slot1212 rv)) \<noteq> SilcLabel)) s \<and> silc_inv aag (?st1237 rv) s \<and> pas_refined aag s \<and> invs s \<and> cte_wp_at ((=) rv) (?slot1250 rv) s \<and> pas_cap_cur_auth aag rv \<and> True \<and> cte_wp_at ((=) rv) slot s \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s)\<rbrace>, -
 5. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; is_final_cap' rv s; cte_wp_at ((=) rv) slot s \<and> is_final_cap' rv s \<longrightarrow> intra_label_cap aag slot s \<or> pasObjectAbs aag (fst slot) = SilcLabel\<rbrakk> \<Longrightarrow> case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True
 2. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> silc_inv aag (?st891 rv s'' (is_final_cap' rv s)) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) (?slot905 rv s'' (is_final_cap' rv s)) s \<and> valid_mdb s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s) \<and> cte_wp_at ((=) rv) (?slot950 rv s'' (is_final_cap' rv s)) s \<and> (is_cnode_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_thread_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv))
 3. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 4. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> (silc_inv aag (?st1208 rv) and (\<lambda>s. cte_wp_at ((=) rv) (?slot1212 rv) s \<and> aag_can_read aag (fst (?slot1212 rv)) \<and> pasObjectAbs aag (fst (?slot1212 rv)) \<noteq> SilcLabel)) s \<and> silc_inv aag (?st1237 rv) s \<and> pas_refined aag s \<and> invs s \<and> cte_wp_at ((=) rv) (?slot1250 rv) s \<and> pas_cap_cur_auth aag rv \<and> True \<and> cte_wp_at ((=) rv) slot s \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s)\<rbrace>, -
 5. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; is_final_cap' rv s; intra_label_cap aag slot s \<or> pasSubject aag = SilcLabel\<rbrakk> \<Longrightarrow> case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True
 2. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> silc_inv aag (?st891 rv s'' (is_final_cap' rv s)) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) (?slot905 rv s'' (is_final_cap' rv s)) s \<and> valid_mdb s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s) \<and> cte_wp_at ((=) rv) (?slot950 rv s'' (is_final_cap' rv s)) s \<and> (is_cnode_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_thread_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv))
 3. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 4. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> (silc_inv aag (?st1208 rv) and (\<lambda>s. cte_wp_at ((=) rv) (?slot1212 rv) s \<and> aag_can_read aag (fst (?slot1212 rv)) \<and> pasObjectAbs aag (fst (?slot1212 rv)) \<noteq> SilcLabel)) s \<and> silc_inv aag (?st1237 rv) s \<and> pas_refined aag s \<and> invs s \<and> cte_wp_at ((=) rv) (?slot1250 rv) s \<and> pas_cap_cur_auth aag rv \<and> True \<and> cte_wp_at ((=) rv) slot s \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s)\<rbrace>, -
 5. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; is_final_cap' rv s; intra_label_cap aag slot s\<rbrakk> \<Longrightarrow> case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True
 2. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; is_final_cap' rv s; pasSubject aag = SilcLabel\<rbrakk> \<Longrightarrow> case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True
 3. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> silc_inv aag (?st891 rv s'' (is_final_cap' rv s)) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) (?slot905 rv s'' (is_final_cap' rv s)) s \<and> valid_mdb s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s) \<and> cte_wp_at ((=) rv) (?slot950 rv s'' (is_final_cap' rv s)) s \<and> (is_cnode_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_thread_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv))
 4. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 5. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> (silc_inv aag (?st1208 rv) and (\<lambda>s. cte_wp_at ((=) rv) (?slot1212 rv) s \<and> aag_can_read aag (fst (?slot1212 rv)) \<and> pasObjectAbs aag (fst (?slot1212 rv)) \<noteq> SilcLabel)) s \<and> silc_inv aag (?st1237 rv) s \<and> pas_refined aag s \<and> invs s \<and> cte_wp_at ((=) rv) (?slot1250 rv) s \<and> pas_cap_cur_auth aag rv \<and> True \<and> cte_wp_at ((=) rv) slot s \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s)\<rbrace>, -
 6. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; is_final_cap' rv s; cap_points_to_label aag rv (pasObjectAbs aag (fst slot))\<rbrakk> \<Longrightarrow> case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True
 2. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; is_final_cap' rv s; pasSubject aag = SilcLabel\<rbrakk> \<Longrightarrow> case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True
 3. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> silc_inv aag (?st891 rv s'' (is_final_cap' rv s)) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) (?slot905 rv s'' (is_final_cap' rv s)) s \<and> valid_mdb s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s) \<and> cte_wp_at ((=) rv) (?slot950 rv s'' (is_final_cap' rv s)) s \<and> (is_cnode_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_thread_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv))
 4. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 5. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> (silc_inv aag (?st1208 rv) and (\<lambda>s. cte_wp_at ((=) rv) (?slot1212 rv) s \<and> aag_can_read aag (fst (?slot1212 rv)) \<and> pasObjectAbs aag (fst (?slot1212 rv)) \<noteq> SilcLabel)) s \<and> silc_inv aag (?st1237 rv) s \<and> pas_refined aag s \<and> invs s \<and> cte_wp_at ((=) rv) (?slot1250 rv) s \<and> pas_cap_cur_auth aag rv \<and> True \<and> cte_wp_at ((=) rv) slot s \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s)\<rbrace>, -
 6. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s; is_final_cap' rv s; pasSubject aag = SilcLabel\<rbrakk> \<Longrightarrow> case rv of EndpointCap r badge rights \<Rightarrow> is_subject aag r | NotificationCap r badge rights \<Rightarrow> is_subject aag r | _ \<Rightarrow> True
 2. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> silc_inv aag (?st891 rv s'' (is_final_cap' rv s)) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) (?slot905 rv s'' (is_final_cap' rv s)) s \<and> valid_mdb s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s) \<and> cte_wp_at ((=) rv) (?slot950 rv s'' (is_final_cap' rv s)) s \<and> (is_cnode_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_thread_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv))
 3. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 4. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> (silc_inv aag (?st1208 rv) and (\<lambda>s. cte_wp_at ((=) rv) (?slot1212 rv) s \<and> aag_can_read aag (fst (?slot1212 rv)) \<and> pasObjectAbs aag (fst (?slot1212 rv)) \<noteq> SilcLabel)) s \<and> silc_inv aag (?st1237 rv) s \<and> pas_refined aag s \<and> invs s \<and> cte_wp_at ((=) rv) (?slot1250 rv) s \<and> pas_cap_cur_auth aag rv \<and> True \<and> cte_wp_at ((=) rv) slot s \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s)\<rbrace>, -
 5. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' s. \<lbrakk>(rv, s'') \<in> fst (get_cap slot s); rv \<noteq> NullCap; cte_wp_at ((=) rv) slot s; only_timer_irq_inv irq st' s; silc_inv aag st s; pas_refined aag s; pas_cap_cur_auth aag rv; invs s; valid_list s; valid_sched s; simple_sched_action s; s \<turnstile> rv; is_subject aag (fst slot); emptyable slot s; ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> silc_inv aag (?st891 rv s'' (is_final_cap' rv s)) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_mdb s \<and> cte_wp_at ((=) rv) (?slot905 rv s'' (is_final_cap' rv s)) s \<and> valid_mdb s \<and> valid_objs s \<and> sym_refs (state_refs_of s) \<and> (cap_irqs rv \<noteq> {} \<longrightarrow> if_unsafe_then_cap s \<and> valid_global_refs s) \<and> (is_arch_cap rv \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_arch_caps s) \<and> cte_wp_at ((=) rv) (?slot950 rv s'' (is_final_cap' rv s)) s \<and> (is_cnode_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_thread_cap rv \<longrightarrow> is_subject aag (obj_ref_of rv)) \<and> (is_zombie rv \<longrightarrow> is_subject aag (obj_ref_of rv))
 2. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 3. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> (silc_inv aag (?st1208 rv) and (\<lambda>s. cte_wp_at ((=) rv) (?slot1212 rv) s \<and> aag_can_read aag (fst (?slot1212 rv)) \<and> pasObjectAbs aag (fst (?slot1212 rv)) \<noteq> SilcLabel)) s \<and> silc_inv aag (?st1237 rv) s \<and> pas_refined aag s \<and> invs s \<and> cte_wp_at ((=) rv) (?slot1250 rv) s \<and> pas_cap_cur_auth aag rv \<and> True \<and> cte_wp_at ((=) rv) slot s \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s)\<rbrace>, -
 4. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (3 subgoals):
 1. spec_reads_respects_f s aag l ?P'7 (liftE (get_cap slot))
 2. \<lbrace>?P''7\<rbrace> liftE (get_cap slot) \<lbrace>\<lambda>rv s. (rv = NullCap \<longrightarrow> True) \<and> (rv \<noteq> NullCap \<longrightarrow> (silc_inv aag (?st1208 rv) and (\<lambda>s. cte_wp_at ((=) rv) (?slot1212 rv) s \<and> aag_can_read aag (fst (?slot1212 rv)) \<and> pasObjectAbs aag (fst (?slot1212 rv)) \<noteq> SilcLabel)) s \<and> silc_inv aag (?st1237 rv) s \<and> pas_refined aag s \<and> invs s \<and> cte_wp_at ((=) rv) (?slot1250 rv) s \<and> pas_cap_cur_auth aag rv \<and> True \<and> cte_wp_at ((=) rv) slot s \<and> only_timer_irq_inv irq st' s \<and> silc_inv aag st s \<and> pas_refined aag s \<and> pas_cap_cur_auth aag rv \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> s \<turnstile> rv \<and> is_subject aag (fst slot) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (appropriate_cte_cap rv) slot s)\<rbrace>, -
 3. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> ?P'7 s \<and> ?P''7 s proof (prove)
goal (1 subgoal):
 1. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> emptyable slot s \<and> (\<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s) \<and> is_subject aag (fst slot) \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) slot s \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> silc_inv aag (?st1208 cap) s \<and> cte_wp_at ((=) cap) (?slot1212 cap) s \<and> aag_can_read aag (fst (?slot1212 cap)) \<and> pasObjectAbs aag (fst (?slot1212 cap)) \<noteq> SilcLabel \<and> silc_inv aag (?st1237 cap) s \<and> cte_wp_at ((=) cap) (?slot1250 cap) s \<and> pas_cap_cur_auth aag cap \<and> s \<turnstile> cap \<and> ex_cte_cap_wp_to (appropriate_cte_cap cap) slot s proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; pas_refined aag s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cte_wp_at ((=) cap) slot s; cap \<noteq> NullCap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1208 cap) s \<and> cte_wp_at ((=) cap) (?slot1212 cap) s \<and> aag_can_read aag (fst (?slot1212 cap)) \<and> pasObjectAbs aag (fst (?slot1212 cap)) \<noteq> SilcLabel \<and> silc_inv aag (?st1237 cap) s \<and> cte_wp_at ((=) cap) (?slot1250 cap) s \<and> pas_cap_cur_auth aag cap \<and> s \<turnstile> cap \<and> ex_cte_cap_wp_to (appropriate_cte_cap cap) slot s proof (prove)
goal (3 subgoals):
 1. \<And>s cap. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; pas_refined aag s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cte_wp_at ((=) cap) slot s; cap \<noteq> NullCap\<rbrakk> \<Longrightarrow> pas_cap_cur_auth aag cap
 2. \<And>s cap. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; pas_refined aag s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cte_wp_at ((=) cap) slot s; cap \<noteq> NullCap\<rbrakk> \<Longrightarrow> s \<turnstile> cap
 3. \<And>s cap. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; pas_refined aag s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cte_wp_at ((=) cap) slot s; cap \<noteq> NullCap\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap cap) slot s proof (prove)
goal (3 subgoals):
 1. \<And>s cap. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cte_wp_at ((=) cap) slot s; cap \<noteq> NullCap\<rbrakk> \<Longrightarrow> caps_of_state s slot = Some cap
 2. \<And>s cap. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; pas_refined aag s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cte_wp_at ((=) cap) slot s; cap \<noteq> NullCap\<rbrakk> \<Longrightarrow> s \<turnstile> cap
 3. \<And>s cap. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; pas_refined aag s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cte_wp_at ((=) cap) slot s; cap \<noteq> NullCap\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap cap) slot s proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; pas_refined aag s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cte_wp_at ((=) cap) slot s; cap \<noteq> NullCap\<rbrakk> \<Longrightarrow> s \<turnstile> cap
 2. \<And>s cap. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; pas_refined aag s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cte_wp_at ((=) cap) slot s; cap \<noteq> NullCap\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap cap) slot s proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; pas_refined aag s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cte_wp_at ((=) cap) slot s; cap \<noteq> NullCap\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap cap) slot s proof (prove)
goal (3 subgoals):
 1. \<And>s cap. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; pas_refined aag s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cap \<noteq> NullCap\<rbrakk> \<Longrightarrow> if_unsafe_then_cap s
 2. \<And>s cap capa. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; pas_refined aag s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cap \<noteq> NullCap; cap = capa\<rbrakk> \<Longrightarrow> capa \<noteq> NullCap
 3. \<And>s cap. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; pas_refined aag s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cap \<noteq> NullCap; ex_cte_cap_wp_to (\<lambda>capa. \<exists>cap'. cap = cap' \<and> appropriate_cte_cap cap' capa) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap cap) slot s proof (prove)
goal (2 subgoals):
 1. \<And>s cap capa. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; pas_refined aag s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cap \<noteq> NullCap; cap = capa\<rbrakk> \<Longrightarrow> capa \<noteq> NullCap
 2. \<And>s cap. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; pas_refined aag s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cap \<noteq> NullCap; ex_cte_cap_wp_to (\<lambda>capa. \<exists>cap'. cap = cap' \<and> appropriate_cte_cap cap' capa) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap cap) slot s proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>silc_inv aag st s; only_timer_irq_inv irq st' s; invs s; valid_list s; valid_sched s; simple_sched_action s; pas_refined aag s; emptyable slot s; \<not> exposed \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s; is_subject aag (fst slot); cap \<noteq> NullCap; ex_cte_cap_wp_to (\<lambda>capa. \<exists>cap'. cap = cap' \<and> appropriate_cte_cap cap' capa) slot s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap cap) slot s proof (prove)
goal:
No subgoals! proof (state)
this:
spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (FinaliseSlotCall slot exposed) and emptyable (slot_rdcall (FinaliseSlotCall slot exposed)) and (\<lambda>s. \<not> exposed_rdcall (FinaliseSlotCall slot exposed) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (FinaliseSlotCall slot exposed)) s) and K (case FinaliseSlotCall slot exposed of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (FinaliseSlotCall slot exposed))

goal (2 subgoals):
 1. \<And>ptr bits n slot s. spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False))
 2. \<And>ptr bits n slot s. (\<And>rv sta. (Inr rv, sta) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> spec_reads_respects_f sta aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall rv False) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and K (case CTEDeleteCall rv False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall rv False))) \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) proof (state)
goal (2 subgoals):
 1. \<And>ptr bits n slot s. spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False))
 2. \<And>ptr bits n slot s. (\<And>rv sta. (Inr rv, sta) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> spec_reads_respects_f sta aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall rv False) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and K (case CTEDeleteCall rv False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall rv False))) \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) proof (state)
this:


goal (2 subgoals):
 1. \<And>ptr bits n slot s. spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False))
 2. \<And>ptr bits n slot s. (\<And>rv sta. (Inr rv, sta) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> spec_reads_respects_f sta aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall rv False) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and K (case CTEDeleteCall rv False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall rv False))) \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) proof (prove)
goal (1 subgoal):
 1. spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) proof (prove)
goal (1 subgoal):
 1. spec_reads_respects_f s aag l (\<lambda>a. silc_inv aag st a \<and> only_timer_irq_inv irq st' a \<and> invs a \<and> valid_list a \<and> valid_sched a \<and> simple_sched_action a \<and> pas_refined aag a \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot a \<and> is_final_cap' (Zombie ptr bits (Suc n)) a \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot a \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot a \<and> is_subject aag (fst slot) \<and> is_subject aag ptr) (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE) proof (prove)
goal (2 subgoals):
 1. spec_reads_respects_f s aag l ?P'3 (doE y <- assertE ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot);
y <- liftE (cap_swap_for_delete (ptr, replicate (zombie_cte_bits bits) False) slot);
returnOk undefined
odE)
 2. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> ?P'3 s proof (prove)
goal (1 subgoal):
 1. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> True \<and> ((ptr, replicate (zombie_cte_bits bits) False) \<noteq> slot \<longrightarrow> (silc_inv aag (?st17 ()) and K (is_subject aag (fst (ptr, replicate (zombie_cte_bits bits) False)) \<and> is_subject aag (fst slot)) and K (pasObjectAbs aag (fst (ptr, replicate (zombie_cte_bits bits) False)) = pasObjectAbs aag (fst slot) \<and> pasObjectAbs aag (fst slot) \<noteq> SilcLabel)) s \<and> True) proof (prove)
goal:
No subgoals! proof (state)
this:
spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot False))

goal (1 subgoal):
 1. \<And>ptr bits n slot s. (\<And>rv sta. (Inr rv, sta) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> spec_reads_respects_f sta aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall rv False) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and K (case CTEDeleteCall rv False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall rv False))) \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) proof (state)
goal (1 subgoal):
 1. \<And>ptr bits n slot s. (\<And>rv sta. (Inr rv, sta) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> spec_reads_respects_f sta aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall rv False) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and K (case CTEDeleteCall rv False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall rv False))) \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) proof (state)
this:
(Inr ?rv, ?st) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> spec_reads_respects_f ?st aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall ?rv False) and emptyable (slot_rdcall (CTEDeleteCall ?rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall ?rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall ?rv False)) s) and K (case CTEDeleteCall ?rv False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall ?rv False))

goal (1 subgoal):
 1. \<And>ptr bits n slot s. (\<And>rv sta. (Inr rv, sta) \<in> fst (returnOk (ptr, nat_to_cref (zombie_cte_bits bits) n) s) \<Longrightarrow> spec_reads_respects_f sta aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall rv False) and emptyable (slot_rdcall (CTEDeleteCall rv False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall rv False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall rv False)) s) and K (case CTEDeleteCall rv False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (CTEDeleteCall rv False))) \<Longrightarrow> spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) proof (prove)
goal (1 subgoal):
 1. spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) proof (prove)
goal (1 subgoal):
 1. spec_reads_respects_f s aag l (\<lambda>a. silc_inv aag st a \<and> only_timer_irq_inv irq st' a \<and> invs a \<and> valid_list a \<and> valid_sched a \<and> simple_sched_action a \<and> pas_refined aag a \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot a \<and> is_final_cap' (Zombie ptr bits (Suc n)) a \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot a \<and> is_subject aag (fst slot) \<and> is_subject aag ptr) (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = Zombie ptr bits (Suc n) then without_preemption $ set_cap (Zombie ptr bits n) slot else assertE (new_cap = NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> first_cslot_of (Zombie ptr bits (Suc n)) \<noteq> slot);
returnOk undefined
odE) proof (prove)
goal (2 subgoals):
 1. spec_reads_respects_f s aag l ?P'3 (doE y <- rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False);
new_cap <- liftE (get_cap slot);
y <- if new_cap = Zombie ptr bits (Suc n) then without_preemption $ set_cap (Zombie ptr bits n) slot else assertE (new_cap = NullCap \<or> is_zombie new_cap \<and> first_cslot_of new_cap = slot \<and> first_cslot_of (Zombie ptr bits (Suc n)) \<noteq> slot);
returnOk undefined
odE)
 2. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> ?P'3 s proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P'73\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>rv s. cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<longrightarrow> silc_inv aag (?st60 rv (Zombie ptr bits (Suc n))) s \<and> (\<not> cap_points_to_label aag (Zombie ptr bits n) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie ptr bits n) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> is_subject aag (fst slot)\<rbrace>, -
 2. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and pas_refined aag and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> K (aag_can_read aag (fst slot)) s \<and> True \<and> ?P'73 s proof (prove)
goal (3 subgoals):
 1. \<lbrace>?P'73\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>_. silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))\<rbrace>, -
 2. \<And>rv s. (silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))) s \<Longrightarrow> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<longrightarrow> silc_inv aag (?st60 rv (Zombie ptr bits (Suc n))) s \<and> (\<not> cap_points_to_label aag (Zombie ptr bits n) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie ptr bits n) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> is_subject aag (fst slot)
 3. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and pas_refined aag and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> K (aag_can_read aag (fst slot)) s \<and> True \<and> ?P'73 s proof (prove)
goal (3 subgoals):
 1. \<And>rv s. (silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))) s \<Longrightarrow> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<longrightarrow> silc_inv aag (?st60 rv (Zombie ptr bits (Suc n))) s \<and> (\<not> cap_points_to_label aag (Zombie ptr bits n) (pasObjectAbs aag (fst slot)) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie ptr bits n) s) \<and> pasObjectAbs aag a = SilcLabel)) \<and> is_subject aag (fst slot)
 2. \<lbrace>?P'73\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>_. silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))\<rbrace>, -
 3. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and pas_refined aag and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> K (aag_can_read aag (fst slot)) s \<and> True \<and> ?P'73 s proof (prove)
goal (3 subgoals):
 1. \<And>a b s. \<lbrakk>silc_inv aag st s; pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> silc_inv aag (?st60 (a, b) (Zombie ptr bits (Suc n))) s \<and> (\<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie ptr bits n) s) \<and> pasObjectAbs aag a = SilcLabel))
 2. \<lbrace>?P'73\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>_. silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))\<rbrace>, -
 3. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and pas_refined aag and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> K (aag_can_read aag (fst slot)) s \<and> True \<and> ?P'73 s proof (prove)
goal (3 subgoals):
 1. \<And>a b s. \<lbrakk>silc_inv aag st s; pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s\<rbrakk> \<Longrightarrow> \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag) \<longrightarrow> (\<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie ptr bits n) s) \<and> pasObjectAbs aag a = SilcLabel)
 2. \<lbrace>?P'73\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>_. silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))\<rbrace>, -
 3. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and pas_refined aag and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> K (aag_can_read aag (fst slot)) s \<and> True \<and> ?P'73 s proof (prove)
goal (3 subgoals):
 1. \<And>a b s. \<lbrakk>silc_inv aag st s; pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag)\<rbrakk> \<Longrightarrow> \<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie ptr bits n) s) \<and> pasObjectAbs aag a = SilcLabel
 2. \<lbrace>?P'73\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>_. silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))\<rbrace>, -
 3. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and pas_refined aag and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> K (aag_can_read aag (fst slot)) s \<and> True \<and> ?P'73 s proof (prove)
goal (5 subgoals):
 1. \<And>a b s. \<lbrakk>pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag)\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (?cap97 a b s)) (?slot97 a b s) s
 2. \<And>a b s. \<lbrakk>pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag)\<rbrakk> \<Longrightarrow> \<not> intra_label_cap aag (?slot97 a b s) s
 3. \<And>a b s. \<lbrakk>pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag); \<exists>lslot. lslot \<in> slots_holding_overlapping_caps (?cap97 a b s) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel\<rbrakk> \<Longrightarrow> \<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie ptr bits n) s) \<and> pasObjectAbs aag a = SilcLabel
 4. \<lbrace>?P'73\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>_. silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))\<rbrace>, -
 5. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and pas_refined aag and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> K (aag_can_read aag (fst slot)) s \<and> True \<and> ?P'73 s proof (prove)
goal (4 subgoals):
 1. \<And>a b s. \<lbrakk>pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag)\<rbrakk> \<Longrightarrow> \<not> intra_label_cap aag slot s
 2. \<And>a b s. \<lbrakk>pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag); \<exists>lslot. lslot \<in> slots_holding_overlapping_caps (Zombie ptr bits (Suc n)) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel\<rbrakk> \<Longrightarrow> \<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie ptr bits n) s) \<and> pasObjectAbs aag a = SilcLabel
 3. \<lbrace>?P'73\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>_. silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))\<rbrace>, -
 4. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and pas_refined aag and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> K (aag_can_read aag (fst slot)) s \<and> True \<and> ?P'73 s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag)\<rbrakk> \<Longrightarrow> \<exists>cap. cte_wp_at ((=) cap) slot s \<and> \<not> cap_points_to_label aag cap (pasSubject aag)
 2. \<And>a b s. \<lbrakk>pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag); \<exists>lslot. lslot \<in> slots_holding_overlapping_caps (Zombie ptr bits (Suc n)) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel\<rbrakk> \<Longrightarrow> \<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie ptr bits n) s) \<and> pasObjectAbs aag a = SilcLabel
 3. \<lbrace>?P'73\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>_. silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))\<rbrace>, -
 4. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and pas_refined aag and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> K (aag_can_read aag (fst slot)) s \<and> True \<and> ?P'73 s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag)\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (?cap101 s)) slot s \<and> \<not> cap_points_to_label aag (?cap101 s) (pasSubject aag)
 2. \<And>a b s. \<lbrakk>pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag); \<exists>lslot. lslot \<in> slots_holding_overlapping_caps (Zombie ptr bits (Suc n)) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel\<rbrakk> \<Longrightarrow> \<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie ptr bits n) s) \<and> pasObjectAbs aag a = SilcLabel
 3. \<lbrace>?P'73\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>_. silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))\<rbrace>, -
 4. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and pas_refined aag and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> K (aag_can_read aag (fst slot)) s \<and> True \<and> ?P'73 s proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag)\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (?cap101 s)) slot s
 2. \<And>s. \<lbrakk>pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag)\<rbrakk> \<Longrightarrow> \<not> cap_points_to_label aag (?cap101 s) (pasSubject aag)
 3. \<And>a b s. \<lbrakk>pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag); \<exists>lslot. lslot \<in> slots_holding_overlapping_caps (Zombie ptr bits (Suc n)) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel\<rbrakk> \<Longrightarrow> \<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie ptr bits n) s) \<and> pasObjectAbs aag a = SilcLabel
 4. \<lbrace>?P'73\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>_. silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))\<rbrace>, -
 5. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and pas_refined aag and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> K (aag_can_read aag (fst slot)) s \<and> True \<and> ?P'73 s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag)\<rbrakk> \<Longrightarrow> \<not> cap_points_to_label aag (Zombie ptr bits (Suc n)) (pasSubject aag)
 2. \<And>a b s. \<lbrakk>pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag); \<exists>lslot. lslot \<in> slots_holding_overlapping_caps (Zombie ptr bits (Suc n)) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel\<rbrakk> \<Longrightarrow> \<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie ptr bits n) s) \<and> pasObjectAbs aag a = SilcLabel
 3. \<lbrace>?P'73\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>_. silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))\<rbrace>, -
 4. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and pas_refined aag and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> K (aag_can_read aag (fst slot)) s \<and> True \<and> ?P'73 s proof (prove)
goal (3 subgoals):
 1. \<And>a b s. \<lbrakk>pasSubject aag \<noteq> SilcLabel; is_subject aag (fst slot); cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s; \<not> cap_points_to_label aag (Zombie ptr bits n) (pasSubject aag); \<exists>lslot. lslot \<in> slots_holding_overlapping_caps (Zombie ptr bits (Suc n)) s \<and> pasObjectAbs aag (fst lslot) = SilcLabel\<rbrakk> \<Longrightarrow> \<exists>a. (\<exists>b. (a, b) \<in> slots_holding_overlapping_caps (Zombie ptr bits n) s) \<and> pasObjectAbs aag a = SilcLabel
 2. \<lbrace>?P'73\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>_. silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))\<rbrace>, -
 3. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and pas_refined aag and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> K (aag_can_read aag (fst slot)) s \<and> True \<and> ?P'73 s proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P'73\<rbrace> rec_del (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<lbrace>\<lambda>_. silc_inv aag st and K (pasObjectAbs aag (fst slot) \<noteq> SilcLabel \<and> is_subject aag (fst slot))\<rbrace>, -
 2. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and (\<lambda>s. \<not> exposed_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) s) and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> (silc_inv aag st and einvs and simple_sched_action and valid_rec_del_call (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False) and emptyable (slot_rdcall (CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False)) and pas_refined aag and K (case CTEDeleteCall (ptr, nat_to_cref (zombie_cte_bits bits) n) False of CTEDeleteCall slot x \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot x \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot x \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) s \<and> K (aag_can_read aag (fst slot)) s \<and> True \<and> ?P'73 s proof (prove)
goal (1 subgoal):
 1. \<And>s. silc_inv aag st s \<and> only_timer_irq_inv irq st' s \<and> invs s \<and> valid_list s \<and> valid_sched s \<and> simple_sched_action s \<and> pas_refined aag s \<and> cte_wp_at ((=) (Zombie ptr bits (Suc n))) slot s \<and> is_final_cap' (Zombie ptr bits (Suc n)) s \<and> is_zombie (Zombie ptr bits (Suc n)) \<and> emptyable slot s \<and> is_subject aag (fst slot) \<and> is_subject aag ptr \<Longrightarrow> emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> emptyable (ptr, nat_to_cref (zombie_cte_bits bits) n) s \<and> pasSubject aag \<noteq> SilcLabel proof (prove)
goal:
No subgoals! proof (state)
this:
spec_reads_respects_f s aag l (silc_inv aag st and only_timer_irq_inv irq st' and einvs and simple_sched_action and pas_refined aag and valid_rec_del_call (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) and emptyable (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) and (\<lambda>s. \<not> exposed_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True) \<longrightarrow> ex_cte_cap_wp_to (\<lambda>cp. cap_irqs cp = {}) (slot_rdcall (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True)) s) and K (case ReduceZombieCall (Zombie ptr bits (Suc n)) slot True of CTEDeleteCall slot exposed \<Rightarrow> is_subject aag (fst slot) | FinaliseSlotCall slot exposed \<Rightarrow> is_subject aag (fst slot) | ReduceZombieCall cap slot exposed \<Rightarrow> is_subject aag (fst slot) \<and> is_subject aag (obj_ref_of cap))) (rec_del (ReduceZombieCall (Zombie ptr bits (Suc n)) slot True))

goal:
No subgoals!