theory Ipc_DR

lemma dcorres_set_thread_state_Restart:
  "dcorres dc \<top>
           (\<lambda>a. valid_mdb a \<and> not_idle_thread recver a \<and> st_tcb_at idle (idle_thread a) a \<and> valid_etcbs a)
           (do y \<leftarrow> delete_cap_simple (recver, tcb_pending_op_slot);
               KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
            od)
           (set_thread_state recver Structures_A.thread_state.Restart)" supply option.case_cong[cong] if_cong[cong] apply (rule dcorres_expand_pfx) apply (case_tac "\<not> tcb_at recver s'") apply (clarsimp simp:set_thread_state_def) apply (clarsimp simp:delete_cap_simple_def bind_assoc) apply (rule dcorres_gets_the) apply (clarsimp simp:tcb_at_def)+ apply (subgoal_tac "dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap)
           (KHeap_A.set_object recver (TCB (update_tcb_state Structures_A.thread_state.Restart y)))") apply (clarsimp simp:delete_cap_simple_def bind_assoc
                        assert_opt_def set_thread_state_def) apply (simp add: bind_assoc[symmetric]) apply (rule dcorres_rhs_noop_below) apply (rule set_thread_state_ext_dcorres) apply (simp add: bind_assoc) apply (rule dcorres_gets_the) apply (simp add:bind_assoc unless_def when_def) apply (clarsimp simp:st_tcb_at_def obj_at_def opt_cap_tcb not_idle_thread_def) apply (simp add:always_empty_slot_def bind_assoc) apply (intro conjI impI) apply (rule corres_symb_exec_l) apply (rule corres_symb_exec_l) apply (rule_tac Q = "\<lambda>rv. (=) (transform s'a)" in corres_symb_exec_l) apply (simp add:corres_underlying_def) apply (frule(1) valid_etcbs_get_tcb_get_etcb, clarsimp) apply (subst set_cap_overlap[unfolded K_def]) apply (drule opt_object_tcb, assumption) apply simp apply (simp add:transform_tcb_def) apply (frule opt_object_tcb, assumption) apply simp apply (clarsimp simp: set_object_def bind_def in_monad gets_the_def simpler_gets_def
                get_def return_def put_def KHeap_D.set_cap_def assert_opt_def transform_tcb_def
                get_object_def
                has_slots_def object_slots_def update_slots_def KHeap_D.set_object_def simpler_modify_def) apply (clarsimp simp: transform_def transform_current_thread_def) apply (intro conjI ext) apply (frule(1) valid_etcbs_get_tcb_get_etcb, clarsimp simp: get_etcb_def) apply (clarsimp simp:transform_objects_def transform_tcb_def
                  infer_tcb_pending_op_def restrict_map_def map_add_def tcb_slots) apply (solves \<open>clarsimp simp: transform_objects_def transform_tcb_def not_idle_thread_def
                                              tcb_slots restrict_map_def map_add_def
                                       dest!: get_tcb_SomeD get_etcb_SomeD\<close>) prefer 2 apply (wp remove_parent_dummy_when_pending_wp) apply (clarsimp simp:valid_mdb_def) apply (simp add:tcb_at_def) apply clarsimp apply (wp remove_parent_dummy_when_pending_slot) apply (simp add:valid_mdb_def) apply (simp add:tcb_at_def get_tcb_def) apply simp apply clarsimp prefer 2 apply (rule_tac P="x = (PageTableUnmap_D.is_final_cap' obj (transform s'a))" in hoare_gen_asm) apply simp apply (subst fast_finalise_no_effect) apply simp apply (simp add: not_idle_thread_def) apply (simp add: tcb_at_def) apply simp apply ((clarsimp simp:tcb_caller_slot_def infer_tcb_pending_op_def cap_counts_def
             tcb_pending_op_slot_def tcb_cspace_slot_def tcb_replycap_slot_def
             tcb_vspace_slot_def PageTableUnmap_D.is_final_cap'_def
             PageTableUnmap_D.is_final_cap_def split:if_split_asm Structures_A.thread_state.splits
            | wp exs_valid_return exs_valid_gets)+)[1] apply clarsimp apply (subst fast_finalise_no_effect) apply simp apply (simp add: not_idle_thread_def) apply (simp add: tcb_at_def) apply simp apply (clarsimp simp:tcb_caller_slot_def infer_tcb_pending_op_def cap_counts_def
            tcb_pending_op_slot_def tcb_cspace_slot_def tcb_replycap_slot_def
            tcb_vspace_slot_def PageTableUnmap_D.is_final_cap'_def
            PageTableUnmap_D.is_final_cap_def split:if_split_asm Structures_A.thread_state.splits
           | wp exs_valid_return exs_valid_gets)+ apply (frule(1) valid_etcbs_get_tcb_get_etcb, clarsimp simp: get_etcb_def) apply (subst opt_cap_tcb) apply simp apply (simp add: get_etcb_def) apply (simp add: not_idle_thread_def) apply (simp add: tcb_pending_op_slot_def) apply ((wp | clarsimp | simp)+)[2] apply (frule(1) valid_etcbs_get_tcb_get_etcb, clarsimp simp: get_etcb_def) apply (simp add:KHeap_D.set_cap_def set_object_def get_object_def gets_the_def gets_def bind_assoc) apply (rule dcorres_absorb_get_l) apply (rule dcorres_absorb_get_r) apply (rule corres_assert_assume[rotated], clarsimp dest!: get_tcb_SomeD) apply (rule corres_assert_assume[rotated], clarsimp dest!: get_tcb_SomeD) apply (rule dcorres_absorb_get_r) apply (frule opt_object_tcb) apply (simp add: get_etcb_def) apply (simp add: not_idle_thread_def) apply (clarsimp simp: assert_opt_def has_slots_def transform_tcb_def object_slots_def
    update_slots_def tcb_ipcbuffer_slot_def KHeap_D.set_object_def simpler_modify_def) apply (clarsimp simp: corres_underlying_def put_def transform_def transform_current_thread_def
    not_idle_thread_def) apply (intro ext conjI) apply (fastforce simp: transform_objects_def transform_tcb_def restrict_map_def map_add_def
                         assert_def infer_tcb_pending_op_def  not_idle_thread_def tcb_slots) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (\<lambda>a. valid_mdb a \<and> not_idle_thread recver a \<and> st_tcb_at idle (idle_thread a) a \<and> valid_etcbs a) (do y <- delete_cap_simple (recver, tcb_pending_op_slot);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (set_thread_state recver Restart) proof (prove)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (\<lambda>a. valid_mdb a \<and> not_idle_thread recver a \<and> st_tcb_at idle (idle_thread a) a \<and> valid_etcbs a) (do y <- delete_cap_simple (recver, tcb_pending_op_slot);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (set_thread_state recver Restart) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>s = transform s'; True; valid_mdb s' \<and> not_idle_thread recver s' \<and> st_tcb_at idle (idle_thread s') s' \<and> valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (do y <- delete_cap_simple (recver, tcb_pending_op_slot);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (set_thread_state recver Restart) proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>s = transform s'; True; valid_mdb s' \<and> not_idle_thread recver s' \<and> st_tcb_at idle (idle_thread s') s' \<and> valid_etcbs s'; \<not> tcb_at recver s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (do y <- delete_cap_simple (recver, tcb_pending_op_slot);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (set_thread_state recver Restart)
 2. \<And>s s'. \<lbrakk>s = transform s'; True; valid_mdb s' \<and> not_idle_thread recver s' \<and> st_tcb_at idle (idle_thread s') s' \<and> valid_etcbs s'; \<not> \<not> tcb_at recver s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (do y <- delete_cap_simple (recver, tcb_pending_op_slot);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (set_thread_state recver Restart) proof (prove)
goal (2 subgoals):
 1. \<And>s'. \<lbrakk>\<not> tcb_at recver s'; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- delete_cap_simple (recver, tcb_pending_op_slot);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (do tcb <- gets_the (get_tcb recver);
y <- KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb));
set_thread_state_ext recver
od)
 2. \<And>s s'. \<lbrakk>s = transform s'; True; valid_mdb s' \<and> not_idle_thread recver s' \<and> st_tcb_at idle (idle_thread s') s' \<and> valid_etcbs s'; \<not> \<not> tcb_at recver s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (do y <- delete_cap_simple (recver, tcb_pending_op_slot);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (set_thread_state recver Restart) proof (prove)
goal (2 subgoals):
 1. \<And>s'. \<lbrakk>\<not> tcb_at recver s'; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
y <- unless (x = cdl_cap.NullCap) (do final <- PageTableUnmap_D.is_final_cap x;
y <- PageTableUnmap_D.fast_finalise x final;
always_empty_slot (recver, tcb_pending_op_slot)
od);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (do tcb <- gets_the (get_tcb recver);
y <- KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb));
set_thread_state_ext recver
od)
 2. \<And>s s'. \<lbrakk>s = transform s'; True; valid_mdb s' \<and> not_idle_thread recver s' \<and> st_tcb_at idle (idle_thread s') s' \<and> valid_etcbs s'; \<not> \<not> tcb_at recver s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (do y <- delete_cap_simple (recver, tcb_pending_op_slot);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (set_thread_state recver Restart) proof (prove)
goal (3 subgoals):
 1. \<And>s' s s'a obj obj'. \<lbrakk>\<not> tcb_at recver s'; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a = Some obj'; opt_cap (recver, tcb_pending_op_slot) s = Some obj\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s'a) (do y <- unless (obj = cdl_cap.NullCap) (do final <- PageTableUnmap_D.is_final_cap obj;
y <- PageTableUnmap_D.fast_finalise obj final;
always_empty_slot (recver, tcb_pending_op_slot)
od);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (do y <- KHeap_A.set_object recver (TCB (update_tcb_state Restart obj'));
set_thread_state_ext recver
od)
 2. \<And>s' s s'a. \<lbrakk>\<not> tcb_at recver s'; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 3. \<And>s s'. \<lbrakk>s = transform s'; True; valid_mdb s' \<and> not_idle_thread recver s' \<and> st_tcb_at idle (idle_thread s') s' \<and> valid_etcbs s'; \<not> \<not> tcb_at recver s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (do y <- delete_cap_simple (recver, tcb_pending_op_slot);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (set_thread_state recver Restart) proof (prove)
goal (1 subgoal):
 1. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- delete_cap_simple (recver, tcb_pending_op_slot);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (set_thread_state recver Restart) proof (prove)
goal (2 subgoals):
 1. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- delete_cap_simple (recver, tcb_pending_op_slot);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (set_thread_state recver Restart)
 2. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (2 subgoals):
 1. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
y <- unless (x = cdl_cap.NullCap) (do final <- PageTableUnmap_D.is_final_cap x;
y <- PageTableUnmap_D.fast_finalise x final;
always_empty_slot (recver, tcb_pending_op_slot)
od);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (do tcb <- gets_the (get_tcb recver);
y <- KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb));
set_thread_state_ext recver
od)
 2. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (2 subgoals):
 1. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (do y <- do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od;
set_thread_state_ext recver
od)
 2. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (5 subgoals):
 1. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> dcorres dc (?Q22 s' y) (?Q'22 s' y) (return ()) (set_thread_state_ext recver)
 2. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od)
 3. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 4. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 5. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (4 subgoals):
 1. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od)
 2. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 3. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 4. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (4 subgoals):
 1. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
y <- unless (x = cdl_cap.NullCap) (do xa <- PageTableUnmap_D.is_final_cap x;
y <- PageTableUnmap_D.fast_finalise x xa;
always_empty_slot (recver, tcb_pending_op_slot)
od);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od)
 2. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 3. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 4. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (5 subgoals):
 1. \<And>s' y s s'a obj obj'. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a = Some obj'; opt_cap (recver, tcb_pending_op_slot) s = Some obj\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s'a) (do y <- unless (obj = cdl_cap.NullCap) (do x <- PageTableUnmap_D.is_final_cap obj;
y <- PageTableUnmap_D.fast_finalise obj x;
always_empty_slot (recver, tcb_pending_op_slot)
od);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (KHeap_A.set_object recver (TCB (update_tcb_state Restart obj')))
 2. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 3. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 4. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 5. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (5 subgoals):
 1. \<And>s' y s s'a obj. \<lbrakk>valid_mdb s'a; not_idle_thread recver s'a; st_tcb_at idle (idle_thread s'a) s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; s' = s'a; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj\<rbrakk> \<Longrightarrow> (obj \<noteq> cdl_cap.NullCap \<longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do x <- PageTableUnmap_D.is_final_cap obj;
x <- PageTableUnmap_D.fast_finalise obj x;
y <- always_empty_slot (recver, tcb_pending_op_slot);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))) \<and> (obj = cdl_cap.NullCap \<longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))))
 2. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 3. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 4. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 5. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (5 subgoals):
 1. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb)\<rbrakk> \<Longrightarrow> (obj \<noteq> cdl_cap.NullCap \<longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do x <- PageTableUnmap_D.is_final_cap obj;
x <- PageTableUnmap_D.fast_finalise obj x;
y <- always_empty_slot (recver, tcb_pending_op_slot);
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))) \<and> (obj = cdl_cap.NullCap \<longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))))
 2. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 3. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 4. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 5. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (5 subgoals):
 1. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb)\<rbrakk> \<Longrightarrow> (obj \<noteq> cdl_cap.NullCap \<longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do x <- PageTableUnmap_D.is_final_cap obj;
x <- PageTableUnmap_D.fast_finalise obj x;
x <- remove_parent (recver, tcb_pending_op_slot);
y <- KHeap_D.set_cap (recver, tcb_pending_op_slot) cdl_cap.NullCap;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))) \<and> (obj = cdl_cap.NullCap \<longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))))
 2. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 3. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 4. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 5. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (6 subgoals):
 1. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do x <- PageTableUnmap_D.is_final_cap obj;
x <- PageTableUnmap_D.fast_finalise obj x;
x <- remove_parent (recver, tcb_pending_op_slot);
y <- KHeap_D.set_cap (recver, tcb_pending_op_slot) cdl_cap.NullCap;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 2. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 3. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 4. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 5. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 6. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (9 subgoals):
 1. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc (?Q47 y s'a obj tcb x) ((=) s'a) (do x <- PageTableUnmap_D.fast_finalise obj x;
x <- remove_parent (recver, tcb_pending_op_slot);
y <- KHeap_D.set_cap (recver, tcb_pending_op_slot) cdl_cap.NullCap;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 2. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 4. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 5. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 6. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 7. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 8. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 9. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (12 subgoals):
 1. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc (?Q52 y s'a obj tcb x xa) ((=) s'a) (do x <- remove_parent (recver, tcb_pending_op_slot);
y <- KHeap_D.set_cap (recver, tcb_pending_op_slot) cdl_cap.NullCap;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 2. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 4. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 5. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 7. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 8. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 9. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 10. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y s'a obj tcb x xa rv. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- KHeap_D.set_cap (recver, tcb_pending_op_slot) cdl_cap.NullCap;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 2. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 4. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 5. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 8. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; \<forall>(r', t')\<in>fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a). \<exists>(r, y)\<in>fst (KHeap_D.set_cap (recver, 5) RestartCap (transform s'a)). transform t' = y; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<forall>(r', t')\<in>fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a). \<exists>(r, y)\<in>fst ((do y <- KHeap_D.set_cap (recver, tcb_pending_op_slot) cdl_cap.NullCap;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (transform s'a)). transform t' = y
 2. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 4. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 5. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 8. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y s'a obj tcb b etcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; \<forall>x\<in>fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (KHeap_D.set_cap (recver, 5) RestartCap (transform s'a)). case x of (r, x) \<Rightarrow> transform t' = x; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ((), b) \<in> fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a); get_etcb recver s'a = Some etcb\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- KHeap_D.set_cap (recver, tcb_pending_op_slot) cdl_cap.NullCap;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od) (transform s'a)). case x of (r, x) \<Rightarrow> transform b = x
 2. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 4. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 5. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 8. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>y s'a obj tcb b etcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; \<forall>x\<in>fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (KHeap_D.set_cap (recver, 5) RestartCap (transform s'a)). case x of (r, x) \<Rightarrow> transform t' = x; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ((), b) \<in> fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a); get_etcb recver s'a = Some etcb\<rbrakk> \<Longrightarrow> cdl_objects (transform s'a) recver = Some (Tcb (?tcb67 y s'a obj tcb b etcb))
 2. \<And>y s'a obj tcb b etcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; \<forall>x\<in>fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (KHeap_D.set_cap (recver, 5) RestartCap (transform s'a)). case x of (r, x) \<Rightarrow> transform t' = x; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ((), b) \<in> fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a); get_etcb recver s'a = Some etcb\<rbrakk> \<Longrightarrow> \<exists>(r, y)\<in>fst (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap (transform s'a)). transform b = y
 3. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 5. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 6. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 8. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 9. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>y s'a obj tcb b etcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; \<forall>x\<in>fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (KHeap_D.set_cap (recver, 5) RestartCap (transform s'a)). case x of (r, x) \<Rightarrow> transform t' = x; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ((), b) \<in> fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a); get_etcb recver s'a = Some etcb\<rbrakk> \<Longrightarrow> recver \<noteq> idle_thread s'a
 2. \<And>y s'a obj tcb b etcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; \<forall>x\<in>fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (KHeap_D.set_cap (recver, 5) RestartCap (transform s'a)). case x of (r, x) \<Rightarrow> transform t' = x; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ((), b) \<in> fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a); get_etcb recver s'a = Some etcb; cdl_objects (transform s'a) recver = Some (transform_tcb (machine_state s'a) recver y etcb)\<rbrakk> \<Longrightarrow> cdl_objects (transform s'a) recver = Some (Tcb (?tcb67 y s'a obj tcb b etcb))
 3. \<And>y s'a obj tcb b etcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; \<forall>x\<in>fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (KHeap_D.set_cap (recver, 5) RestartCap (transform s'a)). case x of (r, x) \<Rightarrow> transform t' = x; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ((), b) \<in> fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a); get_etcb recver s'a = Some etcb\<rbrakk> \<Longrightarrow> \<exists>(r, y)\<in>fst (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap (transform s'a)). transform b = y
 4. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 6. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 7. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 9. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 10. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>y s'a obj tcb b etcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; \<forall>x\<in>fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (KHeap_D.set_cap (recver, 5) RestartCap (transform s'a)). case x of (r, x) \<Rightarrow> transform t' = x; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ((), b) \<in> fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a); get_etcb recver s'a = Some etcb; cdl_objects (transform s'a) recver = Some (transform_tcb (machine_state s'a) recver y etcb)\<rbrakk> \<Longrightarrow> cdl_objects (transform s'a) recver = Some (Tcb (?tcb67 y s'a obj tcb b etcb))
 2. \<And>y s'a obj tcb b etcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; \<forall>x\<in>fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (KHeap_D.set_cap (recver, 5) RestartCap (transform s'a)). case x of (r, x) \<Rightarrow> transform t' = x; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ((), b) \<in> fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a); get_etcb recver s'a = Some etcb\<rbrakk> \<Longrightarrow> \<exists>(r, y)\<in>fst (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap (transform s'a)). transform b = y
 3. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 5. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 6. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 8. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 9. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y s'a obj tcb b etcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; \<forall>x\<in>fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (KHeap_D.set_cap (recver, 5) RestartCap (transform s'a)). case x of (r, x) \<Rightarrow> transform t' = x; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ((), b) \<in> fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a); get_etcb recver s'a = Some etcb\<rbrakk> \<Longrightarrow> \<exists>(r, y)\<in>fst (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap (transform s'a)). transform b = y
 2. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 4. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 5. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 8. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>y s'a obj tcb b etcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; \<forall>x\<in>fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (KHeap_D.set_cap (recver, 5) RestartCap (transform s'a)). case x of (r, x) \<Rightarrow> transform t' = x; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ((), b) \<in> fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a); get_etcb recver s'a = Some etcb\<rbrakk> \<Longrightarrow> recver \<noteq> idle_thread s'a
 2. \<And>y s'a obj tcb b etcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; \<forall>x\<in>fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (KHeap_D.set_cap (recver, 5) RestartCap (transform s'a)). case x of (r, x) \<Rightarrow> transform t' = x; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ((), b) \<in> fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a); get_etcb recver s'a = Some etcb; cdl_objects (transform s'a) recver = Some (transform_tcb (machine_state s'a) recver y etcb)\<rbrakk> \<Longrightarrow> \<exists>(r, y)\<in>fst (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap (transform s'a)). transform b = y
 3. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 5. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 6. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 8. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 9. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y s'a obj tcb b etcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; \<forall>x\<in>fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst (KHeap_D.set_cap (recver, 5) RestartCap (transform s'a)). case x of (r, x) \<Rightarrow> transform t' = x; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ((), b) \<in> fst (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)) s'a); get_etcb recver s'a = Some etcb; cdl_objects (transform s'a) recver = Some (transform_tcb (machine_state s'a) recver y etcb)\<rbrakk> \<Longrightarrow> \<exists>(r, y)\<in>fst (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap (transform s'a)). transform b = y
 2. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 4. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 5. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 8. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y s'a obj tcb etcb tcba a ba. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; get_etcb recver s'a = Some etcb; cdl_objects (transform s'a) recver = Some (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>); kheap s'a recver = Some (TCB tcba); (a, ba) \<in> fst ((if tcb_ipcbuffer_slot = 5 \<and> (if tcb_boundntfn_slot = 5 then Some (infer_tcb_bound_notification (tcb_bound_notification y)) else if tcb_pending_op_slot = 5 then Some (infer_tcb_pending_op recver (tcb_state y)) else if tcb_ipcbuffer_slot = 5 then Some (transform_cap (tcb_ipcframe y)) else if tcb_caller_slot = 5 then Some (transform_cap (tcb_caller y)) else if tcb_replycap_slot = 5 then Some (transform_cap (tcb_reply y)) else if tcb_vspace_slot = 5 then Some (transform_cap (tcb_vtable y)) else if tcb_cspace_slot = 5 then Some (transform_cap (tcb_ctable y)) else None) \<noteq> Some RestartCap then \<lambda>s. (\<Union>a\<in>fst (select UNIV s). fst (case a of (intent', s) \<Rightarrow> ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_ipcbuffer_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False)), (\<exists>x\<in>fst (select UNIV s). snd (case x of (intent', s) \<Rightarrow> ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_ipcbuffer_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False))) \<or> snd (select UNIV s)) else (\<lambda>s. ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), 5 \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False))) (transform s'a)); transform (update_kheap ((kheap s'a)(recver \<mapsto> TCB (update_tcb_state Restart y))) s'a) = dupdate_cdl_object recver a ba\<rbrakk> \<Longrightarrow> dupdate_cdl_object recver a ba = dupdate_cdl_object recver (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_pending_op_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>) (transform s'a)
 2. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 4. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 5. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 8. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y s'a obj tcb etcb tcba a ba. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = if cur_thread s'a \<noteq> idle_thread s'a then Some (cur_thread s'a) else None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; get_etcb recver s'a = Some etcb; transform_objects s'a recver = Some (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>); kheap s'a recver = Some (TCB tcba); (a, ba) \<in> fst ((if tcb_ipcbuffer_slot = 5 \<and> (if tcb_boundntfn_slot = 5 then Some (infer_tcb_bound_notification (tcb_bound_notification y)) else if tcb_pending_op_slot = 5 then Some (infer_tcb_pending_op recver (tcb_state y)) else if tcb_ipcbuffer_slot = 5 then Some (transform_cap (tcb_ipcframe y)) else if tcb_caller_slot = 5 then Some (transform_cap (tcb_caller y)) else if tcb_replycap_slot = 5 then Some (transform_cap (tcb_reply y)) else if tcb_vspace_slot = 5 then Some (transform_cap (tcb_vtable y)) else if tcb_cspace_slot = 5 then Some (transform_cap (tcb_ctable y)) else None) \<noteq> Some RestartCap then \<lambda>s. (\<Union>a\<in>fst (select UNIV s). fst (case a of (intent', s) \<Rightarrow> ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_ipcbuffer_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False)), (\<exists>x\<in>fst (select UNIV s). snd (case x of (intent', s) \<Rightarrow> ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_ipcbuffer_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False))) \<or> snd (select UNIV s)) else (\<lambda>s. ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), 5 \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False))) \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = if cur_thread s'a \<noteq> idle_thread s'a then Some (cur_thread s'a) else None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr>); \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects (update_kheap ((kheap s'a)(recver \<mapsto> TCB (update_tcb_state Restart y))) s'a), cdl_cdt = transform_cdt s'a, cdl_current_thread = if cur_thread s'a \<noteq> idle_thread s'a then Some (cur_thread s'a) else None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> = dupdate_cdl_object recver a ba\<rbrakk> \<Longrightarrow> (cur_thread s'a \<noteq> idle_thread s'a \<longrightarrow> dupdate_cdl_object recver a ba = \<lparr>cdl_arch = ARM11, cdl_objects = (transform_objects s'a)(recver \<mapsto> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_pending_op_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>), cdl_cdt = transform_cdt s'a, cdl_current_thread = Some (cur_thread s'a), cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr>) \<and> (cur_thread s'a = idle_thread s'a \<longrightarrow> dupdate_cdl_object recver a ba = \<lparr>cdl_arch = ARM11, cdl_objects = (transform_objects s'a)(recver \<mapsto> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_pending_op_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>), cdl_cdt = transform_cdt s'a, cdl_current_thread = None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr>)
 2. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 4. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 5. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 8. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>y s'a obj tcb etcb tcba a ba. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = if cur_thread s'a \<noteq> idle_thread s'a then Some (cur_thread s'a) else None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; get_etcb recver s'a = Some etcb; transform_objects s'a recver = Some (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>); kheap s'a recver = Some (TCB tcba); (a, ba) \<in> fst ((if tcb_ipcbuffer_slot = 5 \<and> (if tcb_boundntfn_slot = 5 then Some (infer_tcb_bound_notification (tcb_bound_notification y)) else if tcb_pending_op_slot = 5 then Some (infer_tcb_pending_op recver (tcb_state y)) else if tcb_ipcbuffer_slot = 5 then Some (transform_cap (tcb_ipcframe y)) else if tcb_caller_slot = 5 then Some (transform_cap (tcb_caller y)) else if tcb_replycap_slot = 5 then Some (transform_cap (tcb_reply y)) else if tcb_vspace_slot = 5 then Some (transform_cap (tcb_vtable y)) else if tcb_cspace_slot = 5 then Some (transform_cap (tcb_ctable y)) else None) \<noteq> Some RestartCap then \<lambda>s. (\<Union>a\<in>fst (select UNIV s). fst (case a of (intent', s) \<Rightarrow> ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_ipcbuffer_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False)), (\<exists>x\<in>fst (select UNIV s). snd (case x of (intent', s) \<Rightarrow> ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_ipcbuffer_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False))) \<or> snd (select UNIV s)) else (\<lambda>s. ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), 5 \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False))) \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = if cur_thread s'a \<noteq> idle_thread s'a then Some (cur_thread s'a) else None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr>); \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects (update_kheap ((kheap s'a)(recver \<mapsto> TCB (update_tcb_state Restart y))) s'a), cdl_cdt = transform_cdt s'a, cdl_current_thread = if cur_thread s'a \<noteq> idle_thread s'a then Some (cur_thread s'a) else None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> = dupdate_cdl_object recver a ba\<rbrakk> \<Longrightarrow> cur_thread s'a \<noteq> idle_thread s'a \<longrightarrow> dupdate_cdl_object recver a ba = \<lparr>cdl_arch = ARM11, cdl_objects = (transform_objects s'a)(recver \<mapsto> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_pending_op_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>), cdl_cdt = transform_cdt s'a, cdl_current_thread = Some (cur_thread s'a), cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr>
 2. \<And>y s'a obj tcb etcb tcba a ba. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = if cur_thread s'a \<noteq> idle_thread s'a then Some (cur_thread s'a) else None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; get_etcb recver s'a = Some etcb; transform_objects s'a recver = Some (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>); kheap s'a recver = Some (TCB tcba); (a, ba) \<in> fst ((if tcb_ipcbuffer_slot = 5 \<and> (if tcb_boundntfn_slot = 5 then Some (infer_tcb_bound_notification (tcb_bound_notification y)) else if tcb_pending_op_slot = 5 then Some (infer_tcb_pending_op recver (tcb_state y)) else if tcb_ipcbuffer_slot = 5 then Some (transform_cap (tcb_ipcframe y)) else if tcb_caller_slot = 5 then Some (transform_cap (tcb_caller y)) else if tcb_replycap_slot = 5 then Some (transform_cap (tcb_reply y)) else if tcb_vspace_slot = 5 then Some (transform_cap (tcb_vtable y)) else if tcb_cspace_slot = 5 then Some (transform_cap (tcb_ctable y)) else None) \<noteq> Some RestartCap then \<lambda>s. (\<Union>a\<in>fst (select UNIV s). fst (case a of (intent', s) \<Rightarrow> ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_ipcbuffer_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False)), (\<exists>x\<in>fst (select UNIV s). snd (case x of (intent', s) \<Rightarrow> ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_ipcbuffer_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False))) \<or> snd (select UNIV s)) else (\<lambda>s. ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), 5 \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False))) \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = if cur_thread s'a \<noteq> idle_thread s'a then Some (cur_thread s'a) else None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr>); \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects (update_kheap ((kheap s'a)(recver \<mapsto> TCB (update_tcb_state Restart y))) s'a), cdl_cdt = transform_cdt s'a, cdl_current_thread = if cur_thread s'a \<noteq> idle_thread s'a then Some (cur_thread s'a) else None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> = dupdate_cdl_object recver a ba\<rbrakk> \<Longrightarrow> cur_thread s'a = idle_thread s'a \<longrightarrow> dupdate_cdl_object recver a ba = \<lparr>cdl_arch = ARM11, cdl_objects = (transform_objects s'a)(recver \<mapsto> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_pending_op_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>), cdl_cdt = transform_cdt s'a, cdl_current_thread = None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr>
 3. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 5. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 6. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 8. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 9. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>y s'a obj tcb etcb tcba a ba. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = Some (cur_thread s'a), cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ekheap s'a recver = Some etcb; transform_objects s'a recver = Some (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>); kheap s'a recver = Some (TCB tcba); (a, ba) \<in> fst ((if tcb_ipcbuffer_slot = 5 \<and> (if tcb_boundntfn_slot = 5 then Some (infer_tcb_bound_notification (tcb_bound_notification y)) else if tcb_pending_op_slot = 5 then Some (infer_tcb_pending_op recver (tcb_state y)) else if tcb_ipcbuffer_slot = 5 then Some (transform_cap (tcb_ipcframe y)) else if tcb_caller_slot = 5 then Some (transform_cap (tcb_caller y)) else if tcb_replycap_slot = 5 then Some (transform_cap (tcb_reply y)) else if tcb_vspace_slot = 5 then Some (transform_cap (tcb_vtable y)) else if tcb_cspace_slot = 5 then Some (transform_cap (tcb_ctable y)) else None) \<noteq> Some RestartCap then \<lambda>s. (\<Union>a\<in>fst (select UNIV s). fst (case a of (intent', s) \<Rightarrow> ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_ipcbuffer_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False)), (\<exists>x\<in>fst (select UNIV s). snd (case x of (intent', s) \<Rightarrow> ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_ipcbuffer_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False))) \<or> snd (select UNIV s)) else (\<lambda>s. ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), 5 \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False))) \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = Some (cur_thread s'a), cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr>); \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects (update_kheap ((kheap s'a)(recver \<mapsto> TCB (update_tcb_state Restart y))) s'a), cdl_cdt = transform_cdt s'a, cdl_current_thread = Some (cur_thread s'a), cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> = dupdate_cdl_object recver a ba; cur_thread s'a \<noteq> idle_thread s'a\<rbrakk> \<Longrightarrow> dupdate_cdl_object recver a ba = \<lparr>cdl_arch = ARM11, cdl_objects = (transform_objects s'a)(recver \<mapsto> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_pending_op_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>), cdl_cdt = transform_cdt s'a, cdl_current_thread = Some (cur_thread s'a), cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr>
 2. \<And>y s'a obj tcb etcb tcba a ba. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = if cur_thread s'a \<noteq> idle_thread s'a then Some (cur_thread s'a) else None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; get_etcb recver s'a = Some etcb; transform_objects s'a recver = Some (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>); kheap s'a recver = Some (TCB tcba); (a, ba) \<in> fst ((if tcb_ipcbuffer_slot = 5 \<and> (if tcb_boundntfn_slot = 5 then Some (infer_tcb_bound_notification (tcb_bound_notification y)) else if tcb_pending_op_slot = 5 then Some (infer_tcb_pending_op recver (tcb_state y)) else if tcb_ipcbuffer_slot = 5 then Some (transform_cap (tcb_ipcframe y)) else if tcb_caller_slot = 5 then Some (transform_cap (tcb_caller y)) else if tcb_replycap_slot = 5 then Some (transform_cap (tcb_reply y)) else if tcb_vspace_slot = 5 then Some (transform_cap (tcb_vtable y)) else if tcb_cspace_slot = 5 then Some (transform_cap (tcb_ctable y)) else None) \<noteq> Some RestartCap then \<lambda>s. (\<Union>a\<in>fst (select UNIV s). fst (case a of (intent', s) \<Rightarrow> ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_ipcbuffer_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False)), (\<exists>x\<in>fst (select UNIV s). snd (case x of (intent', s) \<Rightarrow> ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_ipcbuffer_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False))) \<or> snd (select UNIV s)) else (\<lambda>s. ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), 5 \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False))) \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = if cur_thread s'a \<noteq> idle_thread s'a then Some (cur_thread s'a) else None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr>); \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects (update_kheap ((kheap s'a)(recver \<mapsto> TCB (update_tcb_state Restart y))) s'a), cdl_cdt = transform_cdt s'a, cdl_current_thread = if cur_thread s'a \<noteq> idle_thread s'a then Some (cur_thread s'a) else None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> = dupdate_cdl_object recver a ba\<rbrakk> \<Longrightarrow> cur_thread s'a = idle_thread s'a \<longrightarrow> dupdate_cdl_object recver a ba = \<lparr>cdl_arch = ARM11, cdl_objects = (transform_objects s'a)(recver \<mapsto> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_pending_op_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>), cdl_cdt = transform_cdt s'a, cdl_current_thread = None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr>
 3. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 5. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 6. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 8. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 9. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y s'a obj tcb etcb tcba a ba. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = if cur_thread s'a \<noteq> idle_thread s'a then Some (cur_thread s'a) else None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; get_etcb recver s'a = Some etcb; transform_objects s'a recver = Some (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>); kheap s'a recver = Some (TCB tcba); (a, ba) \<in> fst ((if tcb_ipcbuffer_slot = 5 \<and> (if tcb_boundntfn_slot = 5 then Some (infer_tcb_bound_notification (tcb_bound_notification y)) else if tcb_pending_op_slot = 5 then Some (infer_tcb_pending_op recver (tcb_state y)) else if tcb_ipcbuffer_slot = 5 then Some (transform_cap (tcb_ipcframe y)) else if tcb_caller_slot = 5 then Some (transform_cap (tcb_caller y)) else if tcb_replycap_slot = 5 then Some (transform_cap (tcb_reply y)) else if tcb_vspace_slot = 5 then Some (transform_cap (tcb_vtable y)) else if tcb_cspace_slot = 5 then Some (transform_cap (tcb_ctable y)) else None) \<noteq> Some RestartCap then \<lambda>s. (\<Union>a\<in>fst (select UNIV s). fst (case a of (intent', s) \<Rightarrow> ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_ipcbuffer_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False)), (\<exists>x\<in>fst (select UNIV s). snd (case x of (intent', s) \<Rightarrow> ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_ipcbuffer_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False))) \<or> snd (select UNIV s)) else (\<lambda>s. ({(Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), 5 \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>, s)}, False))) \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = if cur_thread s'a \<noteq> idle_thread s'a then Some (cur_thread s'a) else None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr>); \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects (update_kheap ((kheap s'a)(recver \<mapsto> TCB (update_tcb_state Restart y))) s'a), cdl_cdt = transform_cdt s'a, cdl_current_thread = if cur_thread s'a \<noteq> idle_thread s'a then Some (cur_thread s'a) else None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> = dupdate_cdl_object recver a ba\<rbrakk> \<Longrightarrow> cur_thread s'a = idle_thread s'a \<longrightarrow> dupdate_cdl_object recver a ba = \<lparr>cdl_arch = ARM11, cdl_objects = (transform_objects s'a)(recver \<mapsto> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), tcb_pending_op_slot \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'a) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>), cdl_cdt = transform_cdt s'a, cdl_current_thread = None, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr>
 2. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 4. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 5. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 8. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 3. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 4. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 7. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q52 y s'a obj tcb x xa\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<lbrace>\<lambda>rv. (=) (transform s'a)\<rbrace>
 2. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q52 y s'a obj tcb x xa s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q52 y s'a obj tcb x xa) (remove_parent (recver, tcb_pending_op_slot))
 4. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>?Q52 y s'a obj tcb x\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 7. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s'a) (cdt s'a)
 2. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> tcb_at recver s'a
 3. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (remove_parent (recver, tcb_pending_op_slot))
 5. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 8. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> tcb_at recver s'a
 2. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (remove_parent (recver, tcb_pending_op_slot))
 4. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 7. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>y s'a obj tcb x xa s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (remove_parent (recver, tcb_pending_op_slot))
 3. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 5. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 6. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 8. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 10. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> remove_parent (recver, tcb_pending_op_slot) \<exists>\<lbrace>\<lambda>r. (=) (transform s'a)\<rbrace>
 2. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (remove_parent (recver, tcb_pending_op_slot))
 3. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 5. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 6. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 8. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 10. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s'a) (cdt s'a)
 2. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> tcb_at recver s'a
 3. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> transform s'a = s
 4. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (remove_parent (recver, tcb_pending_op_slot))
 5. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 8. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> tcb_at recver s'a
 2. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> transform s'a = s
 3. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (remove_parent (recver, tcb_pending_op_slot))
 4. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 7. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> transform s'a = s
 2. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (remove_parent (recver, tcb_pending_op_slot))
 3. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 5. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 6. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 8. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 10. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>y s'a obj tcb x xa. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (remove_parent (recver, tcb_pending_op_slot))
 2. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 4. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 5. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 7. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 8. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 9. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 10. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 3. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 4. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 6. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 7. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 8. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 9. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 10. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?Q47 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 2. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ?Q47 y s'a obj tcb x s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?Q47 y s'a obj tcb x) (PageTableUnmap_D.fast_finalise obj x)
 4. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>?Q47 y s'a obj tcb\<rbrace>
 6. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 7. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 8. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 9. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 10. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'116 y s'a obj tcb x\<rbrace> PageTableUnmap_D.fast_finalise obj x \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 2. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; (?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) (PageTableUnmap_D.fast_finalise obj x)
 4. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>\<lambda>x. ?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace>
 6. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 7. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 8. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 9. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 10. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'116 y s'a obj tcb (PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace> PageTableUnmap_D.fast_finalise obj (PageTableUnmap_D.is_final_cap' obj (transform s'a)) \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 2. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; (?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) (PageTableUnmap_D.fast_finalise obj x)
 4. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>\<lambda>x. ?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace>
 6. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 7. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 8. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 9. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 10. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
A total of 11 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> opt_cap (?y118 y s'a obj tcb x, tcb_pending_op_slot) (transform (?s118 y s'a obj tcb x)) = Some obj
 2. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> not_idle_thread (?y118 y s'a obj tcb x) (?s118 y s'a obj tcb x)
 3. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> tcb_at (?y118 y s'a obj tcb x) (?s118 y s'a obj tcb x)
 4. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> valid_etcbs (?s118 y s'a obj tcb x)
 5. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'118 y s'a obj tcb x (?ya118 y s'a obj tcb x) s'a obj (?tcb118 y s'a obj tcb x) (PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace> return () \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 6. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; (?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) (PageTableUnmap_D.fast_finalise obj x)
 8. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>\<lambda>x. ?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace>
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
A total of 15 subgoals...
flex-flex pairs:
\<lambda>y s'a obj tcb x. ?P'118 y s'a obj tcb x (?ya118 y s'a obj tcb x) s'a obj (?tcb118 y s'a obj tcb x) (PageTableUnmap_D.is_final_cap' obj (transform s'a)) \<equiv>\<^sup>? \<lambda>y s'a obj tcb x. ?P'116 y s'a obj tcb (PageTableUnmap_D.is_final_cap' obj (transform s'a)) proof (prove)
goal (14 subgoals):
 1. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> not_idle_thread recver s'a
 2. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> tcb_at recver s'a
 3. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> valid_etcbs s'a
 4. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'118 y s'a obj tcb x (?ya118 y s'a obj tcb x) s'a obj (?tcb118 y s'a obj tcb x) (PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace> return () \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 5. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; (?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) (PageTableUnmap_D.fast_finalise obj x)
 7. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>\<lambda>x. ?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>y s'a obj tcb x. ?P'118 y s'a obj tcb x (?ya118 y s'a obj tcb x) s'a obj (?tcb118 y s'a obj tcb x) (PageTableUnmap_D.is_final_cap' obj (transform s'a)) \<equiv>\<^sup>? \<lambda>y s'a obj tcb x. ?P'116 y s'a obj tcb (PageTableUnmap_D.is_final_cap' obj (transform s'a)) proof (prove)
goal (13 subgoals):
 1. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> tcb_at recver s'a
 2. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> valid_etcbs s'a
 3. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'118 y s'a obj tcb x (?ya118 y s'a obj tcb x) s'a obj (?tcb118 y s'a obj tcb x) (PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace> return () \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 4. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; (?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) (PageTableUnmap_D.fast_finalise obj x)
 6. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>\<lambda>x. ?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace>
 8. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 10. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
A total of 13 subgoals...
flex-flex pairs:
\<lambda>y s'a obj tcb x. ?P'118 y s'a obj tcb x (?ya118 y s'a obj tcb x) s'a obj (?tcb118 y s'a obj tcb x) (PageTableUnmap_D.is_final_cap' obj (transform s'a)) \<equiv>\<^sup>? \<lambda>y s'a obj tcb x. ?P'116 y s'a obj tcb (PageTableUnmap_D.is_final_cap' obj (transform s'a)) proof (prove)
goal (12 subgoals):
 1. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> valid_etcbs s'a
 2. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'118 y s'a obj tcb x (?ya118 y s'a obj tcb x) s'a obj (?tcb118 y s'a obj tcb x) (PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace> return () \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 3. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; (?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) (PageTableUnmap_D.fast_finalise obj x)
 5. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>\<lambda>x. ?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace>
 7. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 8. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 9. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 10. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>y s'a obj tcb x. ?P'118 y s'a obj tcb x (?ya118 y s'a obj tcb x) s'a obj (?tcb118 y s'a obj tcb x) (PageTableUnmap_D.is_final_cap' obj (transform s'a)) \<equiv>\<^sup>? \<lambda>y s'a obj tcb x. ?P'116 y s'a obj tcb (PageTableUnmap_D.is_final_cap' obj (transform s'a)) proof (prove)
goal (11 subgoals):
 1. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; x = PageTableUnmap_D.is_final_cap' obj (transform s'a)\<rbrakk> \<Longrightarrow> \<lbrace>?P'118 y s'a obj tcb x (?ya118 y s'a obj tcb x) s'a obj (?tcb118 y s'a obj tcb x) (PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace> return () \<lbrace>\<lambda>xa. (=) (transform s'a)\<rbrace>
 2. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; (?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail (?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) (PageTableUnmap_D.fast_finalise obj x)
 4. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>\<lambda>x. ?P'116 y s'a obj tcb x and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace>
 6. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 7. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 8. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 9. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 10. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
A total of 11 subgoals...
flex-flex pairs:
\<lambda>y s'a obj tcb x. ?P'118 y s'a obj tcb x (?ya118 y s'a obj tcb x) s'a obj (?tcb118 y s'a obj tcb x) (PageTableUnmap_D.is_final_cap' obj (transform s'a)) \<equiv>\<^sup>? \<lambda>y s'a obj tcb x. ?P'116 y s'a obj tcb (PageTableUnmap_D.is_final_cap' obj (transform s'a)) proof (prove)
goal (10 subgoals):
 1. \<And>y s'a obj tcb x s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; ((=) (transform s'a) and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.fast_finalise obj x \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a) and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) (PageTableUnmap_D.fast_finalise obj x)
 3. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>\<lambda>x. (=) (transform s'a) and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace>
 5. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 6. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 7. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 8. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 9. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 10. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (10 subgoals):
 1. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.fast_finalise obj (PageTableUnmap_D.is_final_cap' obj (transform s'a)) \<exists>\<lbrace>\<lambda>r. (=) (transform s'a)\<rbrace>
 2. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a) and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) (PageTableUnmap_D.fast_finalise obj x)
 3. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>\<lambda>x. (=) (transform s'a) and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace>
 5. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 6. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 7. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 8. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 9. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 10. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (14 subgoals):
 1. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> opt_cap (?y128 y s'a obj tcb, tcb_pending_op_slot) (transform (?s128 y s'a obj tcb)) = Some obj
 2. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> not_idle_thread (?y128 y s'a obj tcb) (?s128 y s'a obj tcb)
 3. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> tcb_at (?y128 y s'a obj tcb) (?s128 y s'a obj tcb)
 4. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> valid_etcbs (?s128 y s'a obj tcb)
 5. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> return () \<exists>\<lbrace>\<lambda>r. (=) (transform s'a)\<rbrace>
 6. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a) and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) (PageTableUnmap_D.fast_finalise obj x)
 7. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>\<lambda>x. (=) (transform s'a) and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace>
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 10. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> not_idle_thread recver s'a
 2. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> tcb_at recver s'a
 3. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> valid_etcbs s'a
 4. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> return () \<exists>\<lbrace>\<lambda>r. (=) (transform s'a)\<rbrace>
 5. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a) and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) (PageTableUnmap_D.fast_finalise obj x)
 6. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>\<lambda>x. (=) (transform s'a) and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace>
 8. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 9. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 10. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> tcb_at recver s'a
 2. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> valid_etcbs s'a
 3. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> return () \<exists>\<lbrace>\<lambda>r. (=) (transform s'a)\<rbrace>
 4. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a) and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) (PageTableUnmap_D.fast_finalise obj x)
 5. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>\<lambda>x. (=) (transform s'a) and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace>
 7. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 8. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 9. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 10. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> valid_etcbs s'a
 2. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> return () \<exists>\<lbrace>\<lambda>r. (=) (transform s'a)\<rbrace>
 3. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a) and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) (PageTableUnmap_D.fast_finalise obj x)
 4. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>\<lambda>x. (=) (transform s'a) and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace>
 6. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 7. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 8. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 9. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 10. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> return () \<exists>\<lbrace>\<lambda>r. (=) (transform s'a)\<rbrace>
 2. \<And>y s'a obj tcb x. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a) and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))) (PageTableUnmap_D.fast_finalise obj x)
 3. \<And>y s'a obj tcb s. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; transform s'a = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> PageTableUnmap_D.is_final_cap obj \<exists>\<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> PageTableUnmap_D.is_final_cap obj \<lbrace>\<lambda>x. (=) (transform s'a) and K (x = PageTableUnmap_D.is_final_cap' obj (transform s'a))\<rbrace>
 5. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj \<noteq> cdl_cap.NullCap; False\<rbrakk> \<Longrightarrow> no_fail ((=) (transform s'a)) (PageTableUnmap_D.is_final_cap obj)
 6. \<And>y s'a obj tcb. \<lbrakk>valid_mdb s'a; recver \<noteq> idle_thread s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); get_tcb recver s'a = Some y; opt_cap (recver, tcb_pending_op_slot) (transform s'a) = Some obj; kheap s'a (idle_thread s'a) = Some (TCB tcb); idle (tcb_state tcb); obj = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))
 7. \<And>s' y s s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); s = transform s'a; transform s' = s; s' = s'a; get_tcb recver s'a \<noteq> None\<rbrakk> \<Longrightarrow> opt_cap (recver, tcb_pending_op_slot) s \<noteq> None
 8. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 9. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 10. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (4 subgoals):
 1. \<And>y s'a. \<lbrakk>get_tcb recver s'a = Some y; valid_mdb s'a; not_idle_thread recver s'a; st_tcb_at idle (idle_thread s'a) s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (recver, 5) (transform s'a) = Some y
 2. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 3. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 4. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (4 subgoals):
 1. \<And>y s'a etcb. \<lbrakk>get_tcb recver s'a = Some y; valid_mdb s'a; not_idle_thread recver s'a; st_tcb_at idle (idle_thread s'a) s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); ekheap s'a recver = Some etcb\<rbrakk> \<Longrightarrow> \<exists>y. opt_cap (recver, 5) (transform s'a) = Some y
 2. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 3. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 4. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (7 subgoals):
 1. \<And>y s'a etcb ya. \<lbrakk>get_tcb recver s'a = Some y; valid_mdb s'a; not_idle_thread recver s'a; st_tcb_at idle (idle_thread s'a) s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); ekheap s'a recver = Some etcb\<rbrakk> \<Longrightarrow> get_tcb recver s'a = Some (?tcb160 y s'a etcb)
 2. \<And>y s'a etcb ya. \<lbrakk>get_tcb recver s'a = Some y; valid_mdb s'a; not_idle_thread recver s'a; st_tcb_at idle (idle_thread s'a) s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); ekheap s'a recver = Some etcb\<rbrakk> \<Longrightarrow> \<exists>etcb. get_etcb recver s'a = Some etcb
 3. \<And>y s'a etcb ya. \<lbrakk>get_tcb recver s'a = Some y; valid_mdb s'a; not_idle_thread recver s'a; st_tcb_at idle (idle_thread s'a) s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); ekheap s'a recver = Some etcb\<rbrakk> \<Longrightarrow> recver \<noteq> idle_thread s'a
 4. \<And>y s'a etcb. \<lbrakk>get_tcb recver s'a = Some y; valid_mdb s'a; not_idle_thread recver s'a; st_tcb_at idle (idle_thread s'a) s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); ekheap s'a recver = Some etcb\<rbrakk> \<Longrightarrow> \<exists>ya. (if 5 \<in> tcb_abstract_slots then map_option (\<lambda>(getF, uu_, uu_). transform_cap (getF (?tcb160 y s'a etcb))) (tcb_cap_cases (tcb_cnode_index 5)) else if 5 = tcb_pending_op_slot then Some (infer_tcb_pending_op recver (tcb_state (?tcb160 y s'a etcb))) else if 5 = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification (?tcb160 y s'a etcb))) else None) = Some ya
 5. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 6. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 7. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (6 subgoals):
 1. \<And>y s'a etcb ya. \<lbrakk>get_tcb recver s'a = Some y; valid_mdb s'a; not_idle_thread recver s'a; st_tcb_at idle (idle_thread s'a) s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); ekheap s'a recver = Some etcb\<rbrakk> \<Longrightarrow> \<exists>etcb. get_etcb recver s'a = Some etcb
 2. \<And>y s'a etcb ya. \<lbrakk>get_tcb recver s'a = Some y; valid_mdb s'a; not_idle_thread recver s'a; st_tcb_at idle (idle_thread s'a) s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); ekheap s'a recver = Some etcb\<rbrakk> \<Longrightarrow> recver \<noteq> idle_thread s'a
 3. \<And>y s'a etcb. \<lbrakk>get_tcb recver s'a = Some y; valid_mdb s'a; not_idle_thread recver s'a; st_tcb_at idle (idle_thread s'a) s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); ekheap s'a recver = Some etcb\<rbrakk> \<Longrightarrow> \<exists>ya. (if 5 \<in> tcb_abstract_slots then map_option (\<lambda>(getF, uu_, uu_). transform_cap (getF y)) (tcb_cap_cases (tcb_cnode_index 5)) else if 5 = tcb_pending_op_slot then Some (infer_tcb_pending_op recver (tcb_state y)) else if 5 = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification y)) else None) = Some ya
 4. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 5. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 6. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (5 subgoals):
 1. \<And>y s'a etcb ya. \<lbrakk>get_tcb recver s'a = Some y; valid_mdb s'a; not_idle_thread recver s'a; st_tcb_at idle (idle_thread s'a) s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); ekheap s'a recver = Some etcb\<rbrakk> \<Longrightarrow> recver \<noteq> idle_thread s'a
 2. \<And>y s'a etcb. \<lbrakk>get_tcb recver s'a = Some y; valid_mdb s'a; not_idle_thread recver s'a; st_tcb_at idle (idle_thread s'a) s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); ekheap s'a recver = Some etcb\<rbrakk> \<Longrightarrow> \<exists>ya. (if 5 \<in> tcb_abstract_slots then map_option (\<lambda>(getF, uu_, uu_). transform_cap (getF y)) (tcb_cap_cases (tcb_cnode_index 5)) else if 5 = tcb_pending_op_slot then Some (infer_tcb_pending_op recver (tcb_state y)) else if 5 = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification y)) else None) = Some ya
 3. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 4. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 5. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (4 subgoals):
 1. \<And>y s'a etcb. \<lbrakk>get_tcb recver s'a = Some y; valid_mdb s'a; not_idle_thread recver s'a; st_tcb_at idle (idle_thread s'a) s'a; valid_etcbs s'a; dcorres dc ((=) (transform s'a)) ((=) s'a) (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))); ekheap s'a recver = Some etcb\<rbrakk> \<Longrightarrow> \<exists>ya. (if 5 \<in> tcb_abstract_slots then map_option (\<lambda>(getF, uu_, uu_). transform_cap (getF y)) (tcb_cap_cases (tcb_cnode_index 5)) else if 5 = tcb_pending_op_slot then Some (infer_tcb_pending_op recver (tcb_state y)) else if 5 = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification y)) else None) = Some ya
 2. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 3. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 4. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (3 subgoals):
 1. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s')\<rbrace> do y <- do x <- KHeap_D.get_cap (recver, tcb_pending_op_slot);
unless (x = cdl_cap.NullCap) (do y <- PageTableUnmap_D.is_final_cap x >>= PageTableUnmap_D.fast_finalise x;
always_empty_slot (recver, tcb_pending_op_slot)
od)
od;
KHeap_D.set_cap (recver, tcb_pending_op_slot) RestartCap
od \<lbrace>\<lambda>ya. ?Q22 s' y\<rbrace>
 2. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y)))\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> do tcb <- gets_the (get_tcb recver);
KHeap_A.set_object recver (TCB (update_tcb_state Restart tcb))
od \<lbrace>\<lambda>ya. ?Q'22 s' y\<rbrace>
 3. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (1 subgoal):
 1. \<And>s' y. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (1 subgoal):
 1. \<And>s' y etcb. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; ekheap s' recver = Some etcb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_cap (recver, 5) RestartCap) (KHeap_A.set_object recver (TCB (update_tcb_state Restart y))) proof (prove)
goal (1 subgoal):
 1. \<And>s' y etcb. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; ekheap s' recver = Some etcb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do x <- get;
obj <- assert_opt (cdl_objects x recver);
y <- assert (has_slots obj);
(case update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj of Tcb t \<Rightarrow> if 5 = tcb_ipcbuffer_slot \<and> object_slots obj 5 \<noteq> Some RestartCap then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj)) >>= KHeap_D.set_object recver
od) (do x <- get;
ya <- assert (\<exists>y. kheap x recver = Some y);
ya <- assert (a_type (the (kheap x recver)) = ATCB);
s <- get;
put (update_kheap ((kheap s)(recver \<mapsto> TCB (update_tcb_state Restart y))) s)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' y etcb s'a. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; ekheap s' recver = Some etcb; transform s' = transform s'a; s' = s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do obj <- assert_opt (cdl_objects (transform s'a) recver);
y <- assert (has_slots obj);
(case update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj of Tcb t \<Rightarrow> if 5 = tcb_ipcbuffer_slot \<and> object_slots obj 5 \<noteq> Some RestartCap then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj)) >>= KHeap_D.set_object recver
od) (do x <- get;
ya <- assert (\<exists>y. kheap x recver = Some y);
ya <- assert (a_type (the (kheap x recver)) = ATCB);
s <- get;
put (update_kheap ((kheap s)(recver \<mapsto> TCB (update_tcb_state Restart y))) s)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' y etcb s'a s'b. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; ekheap s' recver = Some etcb; transform s' = transform s'a; s' = s'a; transform s'a = transform s'b; s'a = s'b\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'b)) ((=) s'b) (do obj <- assert_opt (cdl_objects (transform s'a) recver);
y <- assert (has_slots obj);
(case update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj of Tcb t \<Rightarrow> if 5 = tcb_ipcbuffer_slot \<and> object_slots obj 5 \<noteq> Some RestartCap then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj)) >>= KHeap_D.set_object recver
od) (do ya <- assert (\<exists>y. kheap s'b recver = Some y);
ya <- assert (a_type (the (kheap s'b recver)) = ATCB);
s <- get;
put (update_kheap ((kheap s)(recver \<mapsto> TCB (update_tcb_state Restart y))) s)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' y etcb s'a s'b. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; ekheap s' recver = Some etcb; transform s' = transform s'a; s' = s'a; transform s'a = transform s'b; s'a = s'b; \<exists>y. kheap s'b recver = Some y\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'b)) ((=) s'b) (do obj <- assert_opt (cdl_objects (transform s'a) recver);
y <- assert (has_slots obj);
(case update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj of Tcb t \<Rightarrow> if 5 = tcb_ipcbuffer_slot \<and> object_slots obj 5 \<noteq> Some RestartCap then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj)) >>= KHeap_D.set_object recver
od) (do ya <- assert (a_type (the (kheap s'b recver)) = ATCB);
s <- get;
put (update_kheap ((kheap s)(recver \<mapsto> TCB (update_tcb_state Restart y))) s)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' y etcb s'a s'b. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; ekheap s' recver = Some etcb; transform s' = transform s'a; s' = s'a; transform s'a = transform s'b; s'a = s'b; \<exists>y. kheap s'b recver = Some y; a_type (the (kheap s'b recver)) = ATCB\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'b)) ((=) s'b) (do obj <- assert_opt (cdl_objects (transform s'a) recver);
y <- assert (has_slots obj);
(case update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj of Tcb t \<Rightarrow> if 5 = tcb_ipcbuffer_slot \<and> object_slots obj 5 \<noteq> Some RestartCap then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj)) >>= KHeap_D.set_object recver
od) (do s <- get;
put (update_kheap ((kheap s)(recver \<mapsto> TCB (update_tcb_state Restart y))) s)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' y etcb s'a s'b s'c. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; ekheap s' recver = Some etcb; transform s' = transform s'a; s' = s'a; transform s'a = transform s'b; s'a = s'b; \<exists>y. kheap s'b recver = Some y; a_type (the (kheap s'b recver)) = ATCB; transform s'b = transform s'c; s'b = s'c\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'c)) ((=) s'c) (do obj <- assert_opt (cdl_objects (transform s'a) recver);
y <- assert (has_slots obj);
(case update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj of Tcb t \<Rightarrow> if 5 = tcb_ipcbuffer_slot \<and> object_slots obj 5 \<noteq> Some RestartCap then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj)) >>= KHeap_D.set_object recver
od) (put (update_kheap ((kheap s'c)(recver \<mapsto> TCB (update_tcb_state Restart y))) s'c)) proof (prove)
goal (3 subgoals):
 1. \<And>s' y etcb s'a s'b s'c. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; ekheap s' recver = Some etcb; transform s' = transform s'a; s' = s'a; transform s'a = transform s'b; s'a = s'b; \<exists>y. kheap s'b recver = Some y; a_type (the (kheap s'b recver)) = ATCB; transform s'b = transform s'c; s'b = s'c\<rbrakk> \<Longrightarrow> get_etcb recver s' = Some (?etcb316 s' y etcb s'a s'b s'c)
 2. \<And>s' y etcb s'a s'b s'c. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; ekheap s' recver = Some etcb; transform s' = transform s'a; s' = s'a; transform s'a = transform s'b; s'a = s'b; \<exists>y. kheap s'b recver = Some y; a_type (the (kheap s'b recver)) = ATCB; transform s'b = transform s'c; s'b = s'c\<rbrakk> \<Longrightarrow> recver \<noteq> idle_thread s'
 3. \<And>s' y etcb s'a s'b s'c. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; ekheap s' recver = Some etcb; transform s' = transform s'a; s' = s'a; transform s'a = transform s'b; s'a = s'b; \<exists>y. kheap s'b recver = Some y; a_type (the (kheap s'b recver)) = ATCB; transform s'b = transform s'c; s'b = s'c; cdl_objects (transform s') recver = Some (transform_tcb (machine_state s') recver y (?etcb316 s' y etcb s'a s'b s'c))\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'c)) ((=) s'c) (do obj <- assert_opt (cdl_objects (transform s'a) recver);
y <- assert (has_slots obj);
(case update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj of Tcb t \<Rightarrow> if 5 = tcb_ipcbuffer_slot \<and> object_slots obj 5 \<noteq> Some RestartCap then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj)) >>= KHeap_D.set_object recver
od) (put (update_kheap ((kheap s'c)(recver \<mapsto> TCB (update_tcb_state Restart y))) s'c)) proof (prove)
goal (2 subgoals):
 1. \<And>s' y etcb s'a s'b s'c. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; ekheap s' recver = Some etcb; transform s' = transform s'a; s' = s'a; transform s'a = transform s'b; s'a = s'b; \<exists>y. kheap s'b recver = Some y; a_type (the (kheap s'b recver)) = ATCB; transform s'b = transform s'c; s'b = s'c\<rbrakk> \<Longrightarrow> recver \<noteq> idle_thread s'
 2. \<And>s' y etcb s'a s'b s'c. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; ekheap s' recver = Some etcb; transform s' = transform s'a; s' = s'a; transform s'a = transform s'b; s'a = s'b; \<exists>y. kheap s'b recver = Some y; a_type (the (kheap s'b recver)) = ATCB; transform s'b = transform s'c; s'b = s'c; cdl_objects (transform s') recver = Some (transform_tcb (machine_state s') recver y etcb)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'c)) ((=) s'c) (do obj <- assert_opt (cdl_objects (transform s'a) recver);
y <- assert (has_slots obj);
(case update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj of Tcb t \<Rightarrow> if 5 = tcb_ipcbuffer_slot \<and> object_slots obj 5 \<noteq> Some RestartCap then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj)) >>= KHeap_D.set_object recver
od) (put (update_kheap ((kheap s'c)(recver \<mapsto> TCB (update_tcb_state Restart y))) s'c)) proof (prove)
goal (1 subgoal):
 1. \<And>s' y etcb s'a s'b s'c. \<lbrakk>get_tcb recver s' = Some y; valid_mdb s'; not_idle_thread recver s'; st_tcb_at idle (idle_thread s') s'; valid_etcbs s'; ekheap s' recver = Some etcb; transform s' = transform s'a; s' = s'a; transform s'a = transform s'b; s'a = s'b; \<exists>y. kheap s'b recver = Some y; a_type (the (kheap s'b recver)) = ATCB; transform s'b = transform s'c; s'b = s'c; cdl_objects (transform s') recver = Some (transform_tcb (machine_state s') recver y etcb)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'c)) ((=) s'c) (do obj <- assert_opt (cdl_objects (transform s'a) recver);
y <- assert (has_slots obj);
(case update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj of Tcb t \<Rightarrow> if 5 = tcb_ipcbuffer_slot \<and> object_slots obj 5 \<noteq> Some RestartCap then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(5 \<mapsto> RestartCap)) obj)) >>= KHeap_D.set_object recver
od) (put (update_kheap ((kheap s'c)(recver \<mapsto> TCB (update_tcb_state Restart y))) s'c)) proof (prove)
goal (1 subgoal):
 1. \<And>y etcb s'c tcb. \<lbrakk>get_tcb recver s'c = Some y; valid_mdb s'c; not_idle_thread recver s'c; st_tcb_at idle (idle_thread s'c) s'c; valid_etcbs s'c; ekheap s'c recver = Some etcb; cdl_objects (transform s'c) recver = Some (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), 4 \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'c) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>); kheap s'c recver = Some (TCB tcb)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'c)) ((=) s'c) (\<lambda>a. ({((), dupdate_cdl_object recver (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), 4 \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), 5 \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'c) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>) a)}, False)) (put (update_kheap ((kheap s'c)(recver \<mapsto> TCB (update_tcb_state Restart y))) s'c)) proof (prove)
goal (1 subgoal):
 1. \<And>y etcb s'c tcb. \<lbrakk>get_tcb recver s'c = Some y; valid_mdb s'c; recver \<noteq> idle_thread s'c; st_tcb_at idle (idle_thread s'c) s'c; valid_etcbs s'c; ekheap s'c recver = Some etcb; transform_objects s'c recver = Some (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), 4 \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'c) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>); kheap s'c recver = Some (TCB tcb)\<rbrakk> \<Longrightarrow> transform_objects (update_kheap ((kheap s'c)(recver \<mapsto> TCB (update_tcb_state Restart y))) s'c) = (transform_objects s'c)(recver \<mapsto> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), 4 \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), 5 \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'c) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>y etcb s'c tcb x. \<lbrakk>get_tcb recver s'c = Some y; valid_mdb s'c; recver \<noteq> idle_thread s'c; st_tcb_at idle (idle_thread s'c) s'c; valid_etcbs s'c; ekheap s'c recver = Some etcb; transform_objects s'c recver = Some (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), 4 \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'c) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>); kheap s'c recver = Some (TCB tcb)\<rbrakk> \<Longrightarrow> transform_objects (update_kheap ((kheap s'c)(recver \<mapsto> TCB (update_tcb_state Restart y))) s'c) x = ((transform_objects s'c)(recver \<mapsto> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable y), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable y), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply y), tcb_caller_slot \<mapsto> transform_cap (tcb_caller y), 4 \<mapsto> transform_cap (tcb_ipcframe y), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op recver (tcb_state y), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification y), 5 \<mapsto> RestartCap], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler y), cdl_tcb_intent = transform_full_intent (machine_state s'c) recver y, cdl_tcb_has_fault = \<exists>ya. tcb_fault y = Some ya, cdl_tcb_domain = tcb_domain etcb\<rparr>)) x proof (prove)
goal:
No subgoals!