theory CSpace_C

lemma emptySlot_ccorres:
  "ccorres dc xfdc
          (valid_mdb' and valid_objs' and pspace_aligned'
                      and untyped_ranges_zero')
          (UNIV \<inter> {s. slot_' s = Ptr slot}
                \<inter> {s. ccap_relation info (cleanupInfo_' s) \<and> cleanup_info_wf' info}  )
          []
          (emptySlot slot info)
          (Call emptySlot_'proc)" supply if_cong[cong] apply (cinit lift: slot_' cleanupInfo_' simp: case_Null_If)

  \<comment> \<open>--- handle the clearUntypedFreeIndex\<close> apply (rule ccorres_split_noop_lhs, rule clearUntypedFreeIndex_noop_ccorres)

  \<comment> \<open>--- instruction: newCTE \<leftarrow> getCTE slot;                 ---\<close> apply (rule ccorres_pre_getCTE)
  \<comment> \<open>--- instruction: CALL on C side\<close> apply (rule ccorres_move_c_guard_cte) apply csymbr apply (rule ccorres_abstract_cleanup) apply (rename_tac cap_tag) apply (rule_tac P="(cap_tag = scast cap_null_cap)
          = (cteCap newCTE = NullCap)" in ccorres_gen_asm2) apply (simp del: Collect_const)

   \<comment> \<open>--- instruction: if-then-else / IF-THEN-ELSE\<close> apply (rule ccorres_cond2'[where R=\<top>])

    \<comment> \<open>*** link between abstract and concrete conditionals ***\<close> apply (clarsimp split: if_split)

    \<comment> \<open>*** proof for the 'else' branch (return () and SKIP) ***\<close> prefer 2 apply (ctac add: ccorres_return_Skip)

    \<comment> \<open>*** proof for the 'then' branch ***\<close>

    \<comment> \<open>---instructions: multiple on C side, including mdbNode fetch\<close> apply (rule ccorres_rhs_assoc)+
              \<comment> \<open>we have to do it here because the first assoc did not apply inside the then block\<close> apply (rule ccorres_move_c_guard_cte | csymbr)+ apply (rule ccorres_symb_exec_r) apply (rule_tac xf'="mdbNode_'" in ccorres_abstract, ceqv) apply (rename_tac "cmdbNode") apply (rule_tac P="cmdbnode_relation (cteMDBNode newCTE) cmdbNode"
        in ccorres_gen_asm2) apply csymbr+

      \<comment> \<open>--- instruction: updateMDB (mdbPrev rva) (mdbNext_update \<dots>) but with Ptr\<dots>\<noteq> NULL on C side\<close> apply (simp only:Ptr_not_null_pointer_not_zero) \<comment> \<open>replaces Ptr p \<noteq> NULL with p\<noteq>0\<close>

      \<comment> \<open>--- instruction: y \<leftarrow> updateMDB (mdbPrev rva) (mdbNext_update (\<lambda>_. mdbNext rva))\<close> apply (ctac (no_simp, no_vcg)
        add: updateMDB_mdbPrev_set_mdbNext)
            \<comment> \<open>here ctac alone does not apply because the subgoal generated
                by the rule are not solvable by simp\<close>
            \<comment> \<open>so we have to use (no_simp) (or apply (rule ccorres_split_nothrow))\<close> apply (simp add: cmdbnode_relation_def) apply assumption
      \<comment> \<open>*** Main goal ***\<close>
      \<comment> \<open>--- instruction: updateMDB (mdbNext rva)
                    (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged rva)
                            (mdbPrev_update (\<lambda>_. mdbPrev rva) mdb));\<close> apply (rule ccorres_rhs_assoc2 )  \<comment> \<open>to group the 2 first C instrutions together\<close> apply (ctac (no_vcg) add: emptySlot_helper)

      \<comment> \<open>--- instruction:  y \<leftarrow> updateCap slot capability.NullCap;\<close> apply (simp del: Collect_const) apply csymbr apply (ctac (no_vcg) pre:) apply csymbr apply (rule ccorres_move_c_guard_cte)
                \<comment> \<open>--- instruction y \<leftarrow> updateMDB slot (\<lambda>a. nullMDBNode);\<close> apply (ctac (no_vcg) add: ccorres_updateMDB_const)

                  \<comment> \<open>the post_cap_deletion case\<close> apply (ctac(no_vcg) add: postCapDeletion_ccorres)

                \<comment> \<open>Haskell pre/post for y \<leftarrow> updateMDB slot (\<lambda>a. nullMDBNode);\<close> apply wp
                \<comment> \<open>C       pre/post for y \<leftarrow> updateMDB slot (\<lambda>a. nullMDBNode);\<close> apply simp
              \<comment> \<open>C pre/post for the 2nd CALL\<close>
            \<comment> \<open>Haskell pre/post for y \<leftarrow> updateCap slot capability.NullCap;\<close> apply wp
            \<comment> \<open>C       pre/post for y \<leftarrow> updateCap slot capability.NullCap;\<close> apply (simp add: Collect_const_mem cmdbnode_relation_def mdb_node_to_H_def nullMDBNode_def)
        \<comment> \<open>Haskell pre/post for the two nested updates\<close> apply wp
        \<comment> \<open>C       pre/post for the two nested updates\<close> apply (simp add: Collect_const_mem ccap_relation_NullCap_iff)
      \<comment> \<open>Haskell pre/post for  (updateMDB (mdbPrev rva) (mdbNext_update (\<lambda>_. mdbNext rva)))\<close> apply (simp, wp)
      \<comment> \<open>C       pre/post for  (updateMDB (mdbPrev rva) (mdbNext_update (\<lambda>_. mdbNext rva)))\<close> apply simp+ apply vcg apply (rule conseqPre, vcg) apply clarsimp apply simp apply (wp hoare_vcg_all_lift hoare_vcg_imp_lift)

  \<comment> \<open>final precondition proof\<close> apply (clarsimp simp: typ_heap_simps Collect_const_mem
                        cte_wp_at_ctes_of) apply (rule conjI)
   \<comment> \<open>Haskell side\<close> apply (simp add: is_aligned_3_prev is_aligned_3_next)

  \<comment> \<open>C side\<close> apply (clarsimp simp: map_comp_Some_iff typ_heap_simps) apply (subst cap_get_tag_isCap) apply (rule ccte_relation_ccap_relation) apply (simp add: ccte_relation_def c_valid_cte_def
                    cl_valid_cte_def c_valid_cap_def) apply simp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') (UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>ccap_relation info \<acute>cleanupInfo \<and> cleanup_info_wf' info\<rbrace>) [] (emptySlot slot info) (Call emptySlot_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') (UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>ccap_relation info \<acute>cleanupInfo \<and> cleanup_info_wf' info\<rbrace>) [] (emptySlot slot info) (Call emptySlot_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1167 cleanupInfo slota) (?Q'1167 cleanupInfo slota) [SKIP] (do y <- clearUntypedFreeIndex slot;
newCTE <- getCTE slot;
if cteCap newCTE = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  lvar_nondet_init mdbNode_' mdbNode_'_update;;
lvar_nondet_init prev_' prev_'_update;;
lvar_nondet_init next_' next_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])));;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>next)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>prev)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(slota\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)
FI)
 2. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1167 cleanupInfo slota s \<and> s' \<in> ?Q'1167 cleanupInfo slota proof (prove)
goal (3 subgoals):
 1. \<And>cleanupInfo slota rv rv'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1173 cleanupInfo slota rv) (?Q'1173 cleanupInfo slota rv rv') [SKIP] (do newCTE <- getCTE slot;
if cteCap newCTE = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  lvar_nondet_init mdbNode_' mdbNode_'_update;;
lvar_nondet_init prev_' prev_'_update;;
lvar_nondet_init next_' next_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])));;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>next)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>prev)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(slota\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)
FI)
 2. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>?Q1173 cleanupInfo slota\<rbrace>
 3. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1173 cleanupInfo slota rv (xfdc s)} proof (prove)
goal (3 subgoals):
 1. \<And>cleanupInfo slota rv rv' newCTE. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1180 cleanupInfo slota rv newCTE) (?P'1178 cleanupInfo slota rv rv' newCTE) [SKIP] (if cteCap newCTE = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))));;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  lvar_nondet_init mdbNode_' mdbNode_'_update;;
lvar_nondet_init prev_' prev_'_update;;
lvar_nondet_init next_' next_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])));;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>next)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>prev)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(slota\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)
FI)
 2. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ?P1180 cleanupInfo slota rv cte s\<rbrace>
 3. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> ?P'1178 cleanupInfo slota rv (xfdc s) (cte_to_H cte')}} proof (prove)
goal (3 subgoals):
 1. \<And>cleanupInfo slota rv rv' newCTE. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1183 cleanupInfo slota rv newCTE) (?C'1182 cleanupInfo slota rv rv' newCTE) [SKIP] (if cteCap newCTE = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])));;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  lvar_nondet_init mdbNode_' mdbNode_'_update;;
lvar_nondet_init prev_' prev_'_update;;
lvar_nondet_init next_' next_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])));;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>next)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>prev)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(slota\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)
FI)
 2. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?A1183 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 3. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> ?C'1182 cleanupInfo slota rv (xfdc s) (cte_to_H cte') \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (3 subgoals):
 1. \<And>cleanupInfo slota rv rv' newCTE ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1183 cleanupInfo slota rv newCTE) (?G'1189 cleanupInfo slota rv rv' newCTE ret__unsigned \<inter> \<lbrace>ret__unsigned = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace>) [SKIP] (if cteCap newCTE = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  lvar_nondet_init mdbNode_' mdbNode_'_update;;
lvar_nondet_init prev_' prev_'_update;;
lvar_nondet_init next_' next_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])));;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>next)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>prev)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(slota\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)
FI)
 2. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?A1183 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 3. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'1189 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (3 subgoals):
 1. \<And>cleanupInfo slota rv rv' newCTE ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1183 cleanupInfo slota rv newCTE) (?G'1478 cleanupInfo slota rv rv' newCTE ret__unsigned) [SKIP] (if cteCap newCTE = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  lvar_nondet_init mdbNode_' mdbNode_'_update;;
lvar_nondet_init prev_' prev_'_update;;
lvar_nondet_init next_' next_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])));;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>next)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>prev)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(slota\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)
FI)
 2. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?A1183 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 3. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> ?G'1478 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (3 subgoals):
 1. \<And>cleanupInfo slota rv rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1183 cleanupInfo slota rv newCTE) (?G'1478 cleanupInfo slota rv rv' newCTE cap_tag) [SKIP] (if cteCap newCTE = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (IF cap_tag \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  lvar_nondet_init mdbNode_' mdbNode_'_update;;
lvar_nondet_init prev_' prev_'_update;;
lvar_nondet_init next_' next_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])));;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>next)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>prev)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(slota\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)
FI)
 2. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?A1183 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 3. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> ?G'1478 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (3 subgoals):
 1. \<And>cleanupInfo slota rv rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; dc rv rv'; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1183 cleanupInfo slota rv newCTE) (?G'1480 cleanupInfo slota rv rv' newCTE cap_tag) [SKIP] (if cteCap newCTE = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (IF cap_tag \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  lvar_nondet_init mdbNode_' mdbNode_'_update;;
lvar_nondet_init prev_' prev_'_update;;
lvar_nondet_init next_' next_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])));;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>next)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),UCAST(32 \<rightarrow> 32) (ptr_val \<acute>prev)))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(slota\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) 0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slota} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)
FI)
 2. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?A1183 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 3. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> ?G'1480 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (3 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1183 cleanupInfo (cte_Ptr slot) () newCTE) (?G'1480 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) [SKIP] (if cteCap newCTE = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (IF cteCap newCTE \<noteq> capability.NullCap THEN
  lvar_nondet_init mdbNode_' mdbNode_'_update;;
lvar_nondet_init prev_' prev_'_update;;
lvar_nondet_init next_' next_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])));;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>next))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>prev))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)
FI)
 2. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (?A1183 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 3. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> ?G'1480 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (5 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (cteCap newCTE \<noteq> capability.NullCap) = (s' \<in> \<lbrace>cteCap newCTE \<noteq> capability.NullCap\<rbrace>)
 2. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1503 cleanupInfo (cte_Ptr slot) () newCTE) (?Rt1499 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) [SKIP] (do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (lvar_nondet_init mdbNode_' mdbNode_'_update;;
lvar_nondet_init prev_' prev_'_update;;
lvar_nondet_init next_' next_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])));;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>next))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>prev))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo))
 3. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1501 cleanupInfo (cte_Ptr slot) () newCTE) (?Rf1497 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) [SKIP] (return ()) SKIP
 4. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ?Pt1503 cleanupInfo slota rv cte s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pf1501 cleanupInfo slota rv cte s) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 5. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> ?Rt1499 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> ?Rf1497 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (4 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1503 cleanupInfo (cte_Ptr slot) () newCTE) (?Rt1499 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) [SKIP] (do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (lvar_nondet_init mdbNode_' mdbNode_'_update;;
lvar_nondet_init prev_' prev_'_update;;
lvar_nondet_init next_' next_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])));;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>next))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>prev))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1501 cleanupInfo (cte_Ptr slot) () newCTE) (?Rf1497 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) [SKIP] (return ()) SKIP
 3. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ?Pt1503 cleanupInfo slota rv cte s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pf1501 cleanupInfo slota rv cte s) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 4. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> ?Rt1499 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> ?Rf1497 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (4 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1501 cleanupInfo (cte_Ptr slot) () newCTE) (?Rf1497 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) [SKIP] (return ()) SKIP
 2. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1503 cleanupInfo (cte_Ptr slot) () newCTE) (?Rt1499 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) [SKIP] (do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (lvar_nondet_init mdbNode_' mdbNode_'_update;;
lvar_nondet_init prev_' prev_'_update;;
lvar_nondet_init next_' next_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])));;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>next))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>prev))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo))
 3. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ?Pt1503 cleanupInfo slota rv cte s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> ?Pf1501 cleanupInfo slota rv cte s) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 4. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> ?Rt1499 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> ?Rf1497 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (3 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1503 cleanupInfo (cte_Ptr slot) () newCTE) (?Rt1499 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) [SKIP] (do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (lvar_nondet_init mdbNode_' mdbNode_'_update;;
lvar_nondet_init prev_' prev_'_update;;
lvar_nondet_init next_' next_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])));;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>next))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>prev))
FI;;
IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo))
 2. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ?Pt1503 cleanupInfo slota rv cte s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 3. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> ?Rt1499 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (3 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt1503 cleanupInfo (cte_Ptr slot) () newCTE) (?Rt1499 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) [SKIP] (do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (lvar_nondet_init mdbNode_' mdbNode_'_update;;
(lvar_nondet_init prev_' prev_'_update;;
(lvar_nondet_init next_' next_'_update;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
(\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
(\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
(IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>next))
FI;;
(IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>prev))
FI;;
(IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo))))))))))))))))
 2. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ?Pt1503 cleanupInfo slota rv cte s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 3. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> ?Rt1499 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (3 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1635 cleanupInfo (cte_Ptr slot) () newCTE) (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) [SKIP] (do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (\<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
(\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
(\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
(IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>next))
FI;;
(IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>prev))
FI;;
(IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)))))))))))))
 2. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> (?A1635 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 3. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (5 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1635 cleanupInfo (cte_Ptr slot) () newCTE) (?Q'1638 cleanupInfo slota rv' newCTE cap_tag) [SKIP] (do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(\<acute>mdbNode);;
(\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>mdbNode);;
(\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
(IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>next))
FI;;
(IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>prev))
FI;;
(IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(\<acute>mdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo))))))))))))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) (?Q'1638 cleanupInfo slota rv' newCTE cap_tag)
 3. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ?A1635 cleanupInfo (cte_Ptr slot) () newCTE s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> (?A1635 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 5. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (5 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag rv'a. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1635 cleanupInfo (cte_Ptr slot) () newCTE) (?G'1644 cleanupInfo slota rv' newCTE cap_tag rv'a) [SKIP] (do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(rv'a);;
(\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(rv'a);;
(\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
(IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>next))
FI;;
(IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>prev))
FI;;
(IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(rv'a);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo))))))))))))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> ?G'1644 cleanupInfo slota rv' newCTE cap_tag (mdbNode_' s)}
 3. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ?A1635 cleanupInfo (cte_Ptr slot) () newCTE s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> (?A1635 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 5. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (5 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1635 cleanupInfo (cte_Ptr slot) () newCTE) (?G'1644 cleanupInfo slota rv' newCTE cap_tag cmdbNode) [SKIP] (do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(cmdbNode);;
(\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(cmdbNode);;
(\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
(IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>next))
FI;;
(IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>prev))
FI;;
(IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(cmdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo))))))))))))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> ?G'1644 cleanupInfo slota rv' newCTE cap_tag (mdbNode_' s)}
 3. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ?A1635 cleanupInfo (cte_Ptr slot) () newCTE s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> (?A1635 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 5. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (5 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1635 cleanupInfo (cte_Ptr slot) () newCTE) (?G'2110 cleanupInfo slota rv' newCTE cap_tag cmdbNode) [SKIP] (do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbPrev_'proc(cmdbNode);;
(\<acute>prev :== cte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(cmdbNode);;
(\<acute>next :== cte_Ptr \<acute>ret__unsigned;;
(IF \<acute>prev \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c prev_' s} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(\<acute>prev\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>next))
FI;;
(IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),ptr_val \<acute>prev))
FI;;
(IF \<acute>next \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(cmdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c next_' s} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(\<acute>next\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo))))))))))))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> ?G'2110 cleanupInfo slota rv' newCTE cap_tag (mdbNode_' s) \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 3. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ?A1635 cleanupInfo (cte_Ptr slot) () newCTE s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> (?A1635 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 5. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (5 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1635 cleanupInfo (cte_Ptr slot) () newCTE) (?G'2939 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned) [SKIP] (do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (IF cte_Ptr ret__unsigneda \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ret__unsigneda} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr ret__unsigneda\<rightarrow>[''cteMDBNode_C'']),ptr_val (cte_Ptr ret__unsigned)))
FI;;
(IF cte_Ptr ret__unsigned \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ret__unsigned} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr ret__unsigned\<rightarrow>[''cteMDBNode_C'']),ptr_val (cte_Ptr ret__unsigneda)))
FI;;
(IF cte_Ptr ret__unsigned \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ret__unsigned} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr ret__unsigned\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(cmdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ret__unsigned} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr ret__unsigned\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo))))))))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>va. va = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. next_'_update (\<lambda>_. cte_Ptr va) sa \<in> ?G'2939 cleanupInfo slota rv' newCTE cap_tag (mdbNode_' s) v va}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 3. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ?A1635 cleanupInfo (cte_Ptr slot) () newCTE s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> (?A1635 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 5. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (5 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1635 cleanupInfo (cte_Ptr slot) () newCTE) (?G'2939 cleanupInfo (cte_Ptr slot) rv' newCTE cap_tag cmdbNode (mdbPrev_CL (mdb_node_lift cmdbNode)) (mdbNext_CL (mdb_node_lift cmdbNode))) [SKIP] (do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (IF mdbPrev_CL (mdb_node_lift cmdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbPrev_CL (mdb_node_lift cmdbNode))} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr (mdbPrev_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']),ptr_val (cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode)))))
FI;;
(IF mdbNext_CL (mdb_node_lift cmdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']),ptr_val (cte_Ptr (mdbPrev_CL (mdb_node_lift cmdbNode)))))
FI;;
(IF mdbNext_CL (mdb_node_lift cmdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(cmdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo))))))))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>va. va = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. next_'_update (\<lambda>_. cte_Ptr va) sa \<in> ?G'2939 cleanupInfo slota rv' newCTE cap_tag (mdbNode_' s) v va}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 3. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ?A1635 cleanupInfo (cte_Ptr slot) () newCTE s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> (?A1635 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 5. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (9 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode)) = cte_Ptr (mdbNext (cteMDBNode newCTE))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> cmdbnode_relation (cteMDBNode newCTE) cmdbNode
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv) (?Q'3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca) [SKIP] (do y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (IF mdbNext_CL (mdb_node_lift cmdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']),ptr_val (cte_Ptr (mdbPrev_CL (mdb_node_lift cmdbNode)))))
FI;;
(IF mdbNext_CL (mdb_node_lift cmdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(cmdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)))))))
 4. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>?Q3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned\<rbrace>
 5. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv (xfdc s)
 6. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 7. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 9. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (8 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> cmdbnode_relation (cteMDBNode newCTE) cmdbNode
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv) (?Q'3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca) [SKIP] (do y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (IF mdbNext_CL (mdb_node_lift cmdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']),ptr_val (cte_Ptr (mdbPrev_CL (mdb_node_lift cmdbNode)))))
FI;;
(IF mdbNext_CL (mdb_node_lift cmdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(cmdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)))))))
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>?Q3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned\<rbrace>
 4. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv (xfdc s)
 5. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 6. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 8. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (7 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv) (?Q'3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca) [SKIP] (do y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (IF mdbNext_CL (mdb_node_lift cmdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']),ptr_val (cte_Ptr (mdbPrev_CL (mdb_node_lift cmdbNode)))))
FI;;
(IF mdbNext_CL (mdb_node_lift cmdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(cmdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)))))))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>?Q3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv (xfdc s)
 4. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 5. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 7. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (7 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv) (?Q'3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca) [SKIP] (do y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (IF mdbNext_CL (mdb_node_lift cmdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']),ptr_val (cte_Ptr (mdbPrev_CL (mdb_node_lift cmdbNode)))))
FI;;
IF mdbNext_CL (mdb_node_lift cmdbNode) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))} (\<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbFirstBadged_'proc(cmdbNode);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))} (CALL mdb_node_ptr_set_mdbFirstBadged_'proc(mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift cmdbNode))\<rightarrow>[''cteMDBNode_C'']),SCAST(32 signed \<rightarrow> 32) \<acute>ret__int))
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo))))))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>?Q3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'3336 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv (xfdc s)
 4. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 5. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 7. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (9 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca rva xfdcb. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3375 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca rva) (?Q'3375 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca rva xfdcb) [SKIP] (do y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)))))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv\<rbrace> updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb)) \<lbrace>?Q3375 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc\<rbrace>
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'3375 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca rva (xfdc s)
 4. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned a\<rbrace>
 5. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 6. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 7. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 9. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (9 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3375 cleanupInfo (cte_Ptr slot) rv' newCTE cap_tag cmdbNode (mdbPrev_CL (mdb_node_lift cmdbNode)) (mdbNext_CL (mdb_node_lift cmdbNode)) () xfdca ()) (?Q'3375 cleanupInfo (cte_Ptr slot) rv' newCTE cap_tag cmdbNode (mdbPrev_CL (mdb_node_lift cmdbNode)) (mdbNext_CL (mdb_node_lift cmdbNode)) () xfdca () xfdcb) [SKIP] (do y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)))))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv\<rbrace> updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb)) \<lbrace>?Q3375 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc\<rbrace>
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'3375 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca rva (xfdc s)
 4. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned a\<rbrace>
 5. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 6. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 7. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 9. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (9 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3375 cleanupInfo (cte_Ptr slot) rv' newCTE cap_tag cmdbNode (mdbPrev_CL (mdb_node_lift cmdbNode)) (mdbNext_CL (mdb_node_lift cmdbNode)) () xfdca ()) (?G'3414 cleanupInfo (cte_Ptr slot) rv' newCTE cap_tag cmdbNode (mdbPrev_CL (mdb_node_lift cmdbNode)) (mdbNext_CL (mdb_node_lift cmdbNode)) () xfdca () xfdcb ret__struct_cap_C) [SKIP] (do y <- updateCap slot capability.NullCap;
y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) ret__struct_cap_C)));;
(\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo))))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv\<rbrace> updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb)) \<lbrace>?Q3375 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc\<rbrace>
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> ?G'3414 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca rva (xfdc s) v}
 4. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned a\<rbrace>
 5. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 6. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 7. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 9. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (11 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdcc. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv xfdcc\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3542 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv) (?Q'3542 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdcc) [SKIP] (do y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (\<acute>ret__struct_mdb_node_C :== CALL mdb_node_new_'proc(0,SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) false,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) \<acute>ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo)))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdc ret__struct_cap_C. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R3546 cleanupInfo (cte_Ptr slot) rv' newCTE cap_tag cmdbNode (mdbPrev_CL (mdb_node_lift cmdbNode)) (mdbNext_CL (mdb_node_lift cmdbNode)) () xfdca ()\<rbrace> updateCap slot capability.NullCap \<lbrace>?Q3542 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdc ret__struct_cap_C\<rbrace>
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'3542 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv (xfdc s)
 4. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv\<rbrace> updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3546 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>
 5. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation capability.NullCap v\<rbrace> \<inter> \<lbrace>slota = slota\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 6. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned a\<rbrace>
 7. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 8. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 9. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdcc ret__struct_mdb_node_C. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv xfdcc; mdb_node_lift ret__struct_mdb_node_C = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3542 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv) (?G'3577 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdcc ret__struct_mdb_node_C) [SKIP] (do y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) ret__struct_mdb_node_C)));;
CALL postCapDeletion_'proc(cleanupInfo))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdc ret__struct_cap_C. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R3546 cleanupInfo (cte_Ptr slot) rv' newCTE cap_tag cmdbNode (mdbPrev_CL (mdb_node_lift cmdbNode)) (mdbNext_CL (mdb_node_lift cmdbNode)) () xfdca ()\<rbrace> updateCap slot capability.NullCap \<lbrace>?Q3542 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdc ret__struct_cap_C\<rbrace>
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. mdb_node_lift v = \<lparr>mdbNext_CL = mdbNext_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) sa)))) && ~~ mask 3, mdbRevocable_CL = mdbRevocable_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) sa)))) && mask 1, mdbFirstBadged_CL = mdbFirstBadged_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) sa)))) && mask 1, mdbPrev_CL = mdbPrev_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) sa)))) && ~~ mask 3\<rparr> \<longrightarrow> sa\<lparr>ret__struct_mdb_node_C_' := v\<rparr> \<in> ?G'3577 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv (xfdc s) v}
 4. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv\<rbrace> updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3546 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>
 5. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation capability.NullCap v\<rbrace> \<inter> \<lbrace>slota = slota\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 6. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned a\<rbrace>
 7. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 8. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 9. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdcc ret__struct_mdb_node_C. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv xfdcc; mdb_node_lift ret__struct_mdb_node_C = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A3646 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv) (?C'3645 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdcc ret__struct_mdb_node_C) [SKIP] (do y <- updateMDB slot (const nullMDBNode);
global.postCapDeletion info
od) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) ret__struct_mdb_node_C));;
CALL postCapDeletion_'proc(cleanupInfo))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdc ret__struct_cap_C. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R3546 cleanupInfo (cte_Ptr slot) rv' newCTE cap_tag cmdbNode (mdbPrev_CL (mdb_node_lift cmdbNode)) (mdbNext_CL (mdb_node_lift cmdbNode)) () xfdca ()\<rbrace> updateCap slot capability.NullCap \<lbrace>\<lambda>a. ?A3646 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdc ret__struct_cap_C a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. mdb_node_lift v = \<lparr>mdbNext_CL = mdbNext_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) sa)))) && ~~ mask 3, mdbRevocable_CL = mdbRevocable_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) sa)))) && mask 1, mdbFirstBadged_CL = mdbFirstBadged_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) sa)))) && mask 1, mdbPrev_CL = mdbPrev_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) sa)))) && ~~ mask 3\<rparr> \<longrightarrow> sa\<lparr>ret__struct_mdb_node_C_' := v\<rparr> \<in> ?C'3645 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv (xfdc s) v \<inter> \<lbrace>True\<rbrace>}
 4. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv\<rbrace> updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3546 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>
 5. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation capability.NullCap v\<rbrace> \<inter> \<lbrace>slota = slota\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 6. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned a\<rbrace>
 7. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 8. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 9. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdcc ret__struct_mdb_node_C y xfdcd. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv xfdcc; mdb_node_lift ret__struct_mdb_node_C = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; dc y xfdcd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3651 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdcc ret__struct_mdb_node_C y) (?Q'3651 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdcc ret__struct_mdb_node_C y xfdcd) [SKIP] (global.postCapDeletion info) (CALL postCapDeletion_'proc(cleanupInfo))
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdc ret__struct_mdb_node_C. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv xfdc; mdb_node_lift ret__struct_mdb_node_C = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>\<rbrakk> \<Longrightarrow> \<lbrace>?R3653 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv\<rbrace> updateMDB slot (const nullMDBNode) \<lbrace>?Q3651 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdc ret__struct_mdb_node_C\<rbrace>
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdcc ret__struct_mdb_node_C s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv xfdcc; mdb_node_lift ret__struct_mdb_node_C = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'3651 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdcc ret__struct_mdb_node_C rva (xfdc s)
 4. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdc ret__struct_cap_C. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R3546 cleanupInfo (cte_Ptr slot) rv' newCTE cap_tag cmdbNode (mdbPrev_CL (mdb_node_lift cmdbNode)) (mdbNext_CL (mdb_node_lift cmdbNode)) () xfdca ()\<rbrace> updateCap slot capability.NullCap \<lbrace>\<lambda>a. (\<lambda>_. slot \<noteq> 0) and ?R3653 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdc ret__struct_cap_C a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 5. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. mdb_node_lift v = \<lparr>mdbNext_CL = mdbNext_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && ~~ mask 3, mdbRevocable_CL = mdbRevocable_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && mask 1, mdbFirstBadged_CL = mdbFirstBadged_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && mask 1, mdbPrev_CL = mdbPrev_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && ~~ mask 3\<rparr> \<longrightarrow> s\<lparr>ret__struct_mdb_node_C_' := v\<rparr> \<in> \<lbrace>cmdbnode_relation nullMDBNode v\<rbrace> \<inter> \<lbrace>cte_Ptr slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 6. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv\<rbrace> updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3546 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>
 7. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation capability.NullCap v\<rbrace> \<inter> \<lbrace>slota = slota\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 8. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned a\<rbrace>
 9. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 10. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdc ret__struct_mdb_node_C. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv xfdc; mdb_node_lift ret__struct_mdb_node_C = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>\<rbrakk> \<Longrightarrow> \<lbrace>?R3653 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv\<rbrace> updateMDB slot (const nullMDBNode) \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdcc ret__struct_mdb_node_C s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv xfdcc; mdb_node_lift ret__struct_mdb_node_C = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cleanupInfo) s \<in> UNIV \<inter> \<lbrace>ccap_relation info \<acute>cap\<rbrace>}
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdc ret__struct_cap_C. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R3546 cleanupInfo (cte_Ptr slot) rv' newCTE cap_tag cmdbNode (mdbPrev_CL (mdb_node_lift cmdbNode)) (mdbNext_CL (mdb_node_lift cmdbNode)) () xfdca ()\<rbrace> updateCap slot capability.NullCap \<lbrace>\<lambda>a. (\<lambda>_. slot \<noteq> 0) and ?R3653 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdc ret__struct_cap_C a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 4. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. mdb_node_lift v = \<lparr>mdbNext_CL = mdbNext_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && ~~ mask 3, mdbRevocable_CL = mdbRevocable_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && mask 1, mdbFirstBadged_CL = mdbFirstBadged_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && mask 1, mdbPrev_CL = mdbPrev_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && ~~ mask 3\<rparr> \<longrightarrow> s\<lparr>ret__struct_mdb_node_C_' := v\<rparr> \<in> \<lbrace>cmdbnode_relation nullMDBNode v\<rbrace> \<inter> \<lbrace>cte_Ptr slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 5. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv\<rbrace> updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3546 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>
 6. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation capability.NullCap v\<rbrace> \<inter> \<lbrace>slota = slota\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 7. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned a\<rbrace>
 8. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 9. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 10. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C rv xfdcc ret__struct_mdb_node_C s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv xfdcc; mdb_node_lift ret__struct_mdb_node_C = \<lparr>mdbNext_CL = 0, mdbRevocable_CL = SCAST(32 signed \<rightarrow> 32) false, mdbFirstBadged_CL = SCAST(32 signed \<rightarrow> 32) false, mdbPrev_CL = 0\<rparr>; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cleanupInfo) s \<in> UNIV \<inter> \<lbrace>ccap_relation info \<acute>cap\<rbrace>}
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdc ret__struct_cap_C. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R3546 cleanupInfo (cte_Ptr slot) rv' newCTE cap_tag cmdbNode (mdbPrev_CL (mdb_node_lift cmdbNode)) (mdbNext_CL (mdb_node_lift cmdbNode)) () xfdca ()\<rbrace> updateCap slot capability.NullCap \<lbrace>\<lambda>a. (\<lambda>_. slot \<noteq> 0) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. mdb_node_lift v = \<lparr>mdbNext_CL = mdbNext_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && ~~ mask 3, mdbRevocable_CL = mdbRevocable_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && mask 1, mdbFirstBadged_CL = mdbFirstBadged_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && mask 1, mdbPrev_CL = mdbPrev_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && ~~ mask 3\<rparr> \<longrightarrow> s\<lparr>ret__struct_mdb_node_C_' := v\<rparr> \<in> \<lbrace>cmdbnode_relation nullMDBNode v\<rbrace> \<inter> \<lbrace>cte_Ptr slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 4. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv\<rbrace> updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3546 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>
 5. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation capability.NullCap v\<rbrace> \<inter> \<lbrace>slota = slota\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 6. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned a\<rbrace>
 7. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 8. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 9. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 10. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdc ret__struct_cap_C. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R3546 cleanupInfo (cte_Ptr slot) rv' newCTE cap_tag cmdbNode (mdbPrev_CL (mdb_node_lift cmdbNode)) (mdbNext_CL (mdb_node_lift cmdbNode)) () xfdca ()\<rbrace> updateCap slot capability.NullCap \<lbrace>\<lambda>a. (\<lambda>_. slot \<noteq> 0) and (\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr slot))\<rbrace>
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. mdb_node_lift v = \<lparr>mdbNext_CL = mdbNext_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && ~~ mask 3, mdbRevocable_CL = mdbRevocable_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && mask 1, mdbFirstBadged_CL = mdbFirstBadged_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && mask 1, mdbPrev_CL = mdbPrev_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && ~~ mask 3\<rparr> \<longrightarrow> s\<lparr>ret__struct_mdb_node_C_' := v\<rparr> \<in> \<lbrace>cmdbnode_relation nullMDBNode v\<rbrace> \<inter> \<lbrace>cte_Ptr slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv\<rbrace> updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb)) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3546 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>
 4. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation capability.NullCap v\<rbrace> \<inter> \<lbrace>slota = slota\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 5. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned a\<rbrace>
 6. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 7. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 8. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 9. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 10. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (9 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned xfdca xfdcb ret__struct_cap_C s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. mdb_node_lift v = \<lparr>mdbNext_CL = mdbNext_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && ~~ mask 3, mdbRevocable_CL = mdbRevocable_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && mask 1, mdbFirstBadged_CL = mdbFirstBadged_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && mask 1, mdbPrev_CL = mdbPrev_' (mdbPrev_'_update (\<lambda>_. 0) (mdbFirstBadged_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbRevocable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (mdbNext_'_update (\<lambda>_. 0) s)))) && ~~ mask 3\<rparr> \<longrightarrow> s\<lparr>ret__struct_mdb_node_C_' := v\<rparr> \<in> \<lbrace>cmdbnode_relation nullMDBNode v\<rbrace> \<inter> \<lbrace>cte_Ptr slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv\<rbrace> updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb)) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. slot \<noteq> 0 \<and> True \<and> cte_wp_at' (\<lambda>_. True) (ptr_val slota) a) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation capability.NullCap v\<rbrace> \<inter> \<lbrace>slota = slota\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 4. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned a\<rbrace>
 5. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 6. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 7. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 8. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 9. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (8 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv\<rbrace> updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb)) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. slot \<noteq> 0 \<and> True \<and> cte_wp_at' (\<lambda>_. True) (ptr_val slota) a) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)\<rbrace>
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation capability.NullCap v\<rbrace> \<inter> \<lbrace>slota = slota\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R3377 cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned a\<rbrace>
 4. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 5. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 6. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 7. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 8. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (7 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned rv xfdca s rva. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv xfdca; dc rva (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation capability.NullCap v\<rbrace> \<inter> \<lbrace>slota = slota\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. True \<and> slot \<noteq> 0 \<and> True \<and> cte_wp_at' (\<lambda>_. True) (ptr_val slota) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val slota) s)\<rbrace>
 3. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 4. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 5. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 6. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 7. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (6 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode)\<rbrakk> \<Longrightarrow> \<lbrace>?R3340 cleanupInfo (cte_Ptr slot) () newCTE\<rbrace> updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE))) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. True \<and> slot \<noteq> 0 \<and> True \<and> cte_wp_at' (\<lambda>_. True) (ptr_val slota) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val slota) s)\<rbrace>
 2. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 3. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 4. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and ?R3340 cleanupInfo (cte_Ptr slot) () newCTE) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 5. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and ?R3340 cleanupInfo slota rv cte and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 6. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (5 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag cmdbNode ret__unsigneda ret__unsigned s rv. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); cmdbnode_relation (cteMDBNode newCTE) cmdbNode; ret__unsigneda = mdbPrev_CL (mdb_node_lift cmdbNode); ret__unsigned = mdbNext_CL (mdb_node_lift cmdbNode); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> UNIV
 2. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> {sa. \<forall>v. v = mdbPrev_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. prev_'_update (\<lambda>_. cte_Ptr v) sa \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. mdbNode_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. next_'_update (\<lambda>_. cte_Ptr v) s \<in> UNIV}}}} \<inter> \<lbrace>cmdbnode_relation (cteMDBNode newCTE) \<^bsup>s\<^esup>mdbNode\<rbrace>}
 3. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and (\<lambda>a. slot \<noteq> 0 \<and> cte_wp_at' (\<lambda>_. True) slot a)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 4. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and (\<lambda>a. slot \<noteq> 0 \<and> cte_wp_at' (\<lambda>_. True) slot a) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 5. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (4 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s. s \<in> (if cmdbnode_relation (cteMDBNode newCTE) (mdbNode_' s) then UNIV else {})}
 2. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and (\<lambda>a. slot \<noteq> 0 \<and> cte_wp_at' (\<lambda>_. True) slot a)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'1632 cleanupInfo (cte_Ptr slot) () rv' newCTE cap_tag \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 3. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and (\<lambda>a. slot \<noteq> 0 \<and> cte_wp_at' (\<lambda>_. True) slot a) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 4. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. mdbNode_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. prev_'_update (\<lambda>_. va) sa \<in> {sa. \<forall>va. next_'_update (\<lambda>_. va) sa \<in> ?C'1632 cleanupInfo slota rv (xfdc s) (cte_to_H cte') v \<inter> \<lbrace>True\<rbrace>}}}) \<and> (sa \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> sa \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (3 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and (\<lambda>a. slot \<noteq> 0 \<and> cte_wp_at' (\<lambda>_. True) slot a)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. mdbNode_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))) s \<in> (if cmdbnode_relation (cteMDBNode newCTE) (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))) then UNIV else {})} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>mdbNode :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])) {s'. (s, s') \<in> rf_sr}
 2. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and (\<lambda>a. slot \<noteq> 0 \<and> cte_wp_at' (\<lambda>_. True) slot a) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 3. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. mdbNode_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. prev_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. next_'_update (\<lambda>_. v) s \<in> {s. mdbNode_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C'']))) s \<in> (if cmdbnode_relation (cteMDBNode (cte_to_H cte')) (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C'']))) then UNIV else {})} \<inter> \<lbrace>True\<rbrace>}}}) \<and> (s \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (3 subgoals):
 1. \<And>cleanupInfo slota rv' newCTE cap_tag s. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (cap_tag = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap newCTE = capability.NullCap); ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode newCTE)) 3 \<and> (mdbNext (cteMDBNode newCTE) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode newCTE)) 3)) and (\<lambda>a. slot \<noteq> 0 \<and> cte_wp_at' (\<lambda>_. True) slot a)) s\<rbrakk> \<Longrightarrow> {s. mdbNode_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))) s \<in> (if cmdbnode_relation (cteMDBNode newCTE) (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))) then UNIV else {})} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (s, mdbNode_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C'']))) sa) \<in> rf_sr}
 2. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and (\<lambda>a. slot \<noteq> 0 \<and> cte_wp_at' (\<lambda>_. True) slot a) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 3. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. mdbNode_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. prev_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. next_'_update (\<lambda>_. v) s \<in> {s. mdbNode_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C'']))) s \<in> (if cmdbnode_relation (cteMDBNode (cte_to_H cte')) (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C'']))) then UNIV else {})} \<inter> \<lbrace>True\<rbrace>}}}) \<and> (s \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (2 subgoals):
 1. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo slota\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. cteCap cte \<noteq> capability.NullCap \<longrightarrow> ((\<lambda>a. is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3)) and (\<lambda>a. slot \<noteq> 0 \<and> cte_wp_at' (\<lambda>_. True) slot a) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s) and (\<lambda>s. cteCap cte = capability.NullCap \<longrightarrow> True) and cte_wp_at' (\<lambda>_. True) (ptr_val slota)) s\<rbrace>
 2. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. mdbNode_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. prev_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. next_'_update (\<lambda>_. v) s \<in> {s. mdbNode_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C'']))) s \<in> (if cmdbnode_relation (cteMDBNode (cte_to_H cte')) (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C'']))) then UNIV else {})} \<inter> \<lbrace>True\<rbrace>}}}) \<and> (s \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (2 subgoals):
 1. \<And>cleanupInfo slota. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot\<rbrakk> \<Longrightarrow> \<lbrace>?R1173 cleanupInfo (cte_Ptr slot)\<rbrace> clearUntypedFreeIndex slot \<lbrace>\<lambda>rv s. \<forall>cte. ctes_of s slot = Some cte \<longrightarrow> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> is_aligned (mdbPrev (cteMDBNode cte)) 3 \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> is_aligned (mdbNext (cteMDBNode cte)) 3) \<and> slot \<noteq> 0 \<and> cte_wp_at' (\<lambda>_. True) slot s) \<and> cte_wp_at' (\<lambda>_. True) slot s\<rbrace>
 2. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and ?R1173 cleanupInfo slota) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. mdbNode_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. prev_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. next_'_update (\<lambda>_. v) s \<in> {s. mdbNode_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C'']))) s \<in> (if cmdbnode_relation (cteMDBNode (cte_to_H cte')) (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C'']))) then UNIV else {})} \<inter> \<lbrace>True\<rbrace>}}}) \<and> (s \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (1 subgoal):
 1. \<And>cleanupInfo slota s s'. \<lbrakk>ccap_relation info cleanupInfo \<and> cleanup_info_wf' info; slota = cte_Ptr slot; (s, s') \<in> rf_sr; (valid_mdb' and valid_objs' and pspace_aligned' and untyped_ranges_zero') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_objs' and untyped_ranges_zero' and (\<lambda>a. \<forall>x. ctes_of a slot \<noteq> Some x \<or> (\<not> cteCap x \<noteq> capability.NullCap \<or> is_aligned (mdbPrev (cteMDBNode x)) 3 \<and> (\<not> mdbNext (cteMDBNode x) \<noteq> 0 \<or> is_aligned (mdbNext (cteMDBNode x)) 3) \<and> slot \<noteq> 0 \<and> cte_wp_at' (\<lambda>_. True) slot a) \<and> cte_wp_at' (\<lambda>_. True) slot a)) s \<and> s' \<in> UNIV \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(slota\<rightarrow>[''cap_C'']))) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(slota\<rightarrow>[''cap_C''])))\<rbrace> \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. mdbNode_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. prev_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. next_'_update (\<lambda>_. v) s \<in> {s. mdbNode_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C'']))) s \<in> (if cmdbnode_relation (cteMDBNode (cte_to_H cte')) (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(slota\<rightarrow>[''cteMDBNode_C'']))) then UNIV else {})} \<inter> \<lbrace>True\<rbrace>}}}) \<and> (s \<notin> \<lbrace>cteCap (cte_to_H cte') \<noteq> capability.NullCap\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>(v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cteCap (cte_to_H cte') = capability.NullCap)\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}} proof (prove)
goal (1 subgoal):
 1. \<And>cleanupInfo s s'. \<lbrakk>(s, s') \<in> rf_sr; ccap_relation info cleanupInfo; cleanup_info_wf' info; valid_mdb' s; valid_objs' s; pspace_aligned' s; untyped_ranges_zero' s\<rbrakk> \<Longrightarrow> (\<forall>x. ctes_of s slot = Some x \<longrightarrow> cteCap x = capability.NullCap \<or> is_aligned (mdbPrev (cteMDBNode x)) 3 \<and> (mdbNext (cteMDBNode x) = 0 \<or> is_aligned (mdbNext (cteMDBNode x)) 3)) \<and> (\<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> (cap_to_H (cap_CL cte') \<noteq> capability.NullCap \<longrightarrow> cmdbnode_relation (mdb_node_to_H (cteMDBNode_CL cte')) (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])))) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cap_to_H (cap_CL cte') = capability.NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>cleanupInfo s s'. \<lbrakk>(s, s') \<in> rf_sr; ccap_relation info cleanupInfo; cleanup_info_wf' info; valid_mdb' s; valid_objs' s; pspace_aligned' s; untyped_ranges_zero' s\<rbrakk> \<Longrightarrow> \<forall>x. ctes_of s slot = Some x \<longrightarrow> cteCap x = capability.NullCap \<or> is_aligned (mdbPrev (cteMDBNode x)) 3 \<and> (mdbNext (cteMDBNode x) = 0 \<or> is_aligned (mdbNext (cteMDBNode x)) 3)
 2. \<And>cleanupInfo s s'. \<lbrakk>(s, s') \<in> rf_sr; ccap_relation info cleanupInfo; cleanup_info_wf' info; valid_mdb' s; valid_objs' s; pspace_aligned' s; untyped_ranges_zero' s\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> (cap_to_H (cap_CL cte') \<noteq> capability.NullCap \<longrightarrow> cmdbnode_relation (mdb_node_to_H (cteMDBNode_CL cte')) (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])))) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cap_to_H (cap_CL cte') = capability.NullCap) proof (prove)
goal (1 subgoal):
 1. \<And>cleanupInfo s s'. \<lbrakk>(s, s') \<in> rf_sr; ccap_relation info cleanupInfo; cleanup_info_wf' info; valid_mdb' s; valid_objs' s; pspace_aligned' s; untyped_ranges_zero' s\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr slot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> (cap_to_H (cap_CL cte') \<noteq> capability.NullCap \<longrightarrow> cmdbnode_relation (mdb_node_to_H (cteMDBNode_CL cte')) (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr slot\<rightarrow>[''cteMDBNode_C''])))) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cap_to_H (cap_CL cte') = capability.NullCap) proof (prove)
goal (1 subgoal):
 1. \<And>cleanupInfo s s' cte' k'. \<lbrakk>(s, s') \<in> rf_sr; ccap_relation info cleanupInfo; cleanup_info_wf' info; valid_mdb' s; valid_objs' s; pspace_aligned' s; untyped_ranges_zero' s; cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some k'; cte_lift k' = Some cte'\<rbrakk> \<Longrightarrow> (cap_get_tag (cte_C.cap_C k') = SCAST(32 signed \<rightarrow> 32) cap_null_cap) = (cap_to_H (cap_CL cte') = capability.NullCap) proof (prove)
goal (2 subgoals):
 1. \<And>cleanupInfo s s' cte' k'. \<lbrakk>(s, s') \<in> rf_sr; ccap_relation info cleanupInfo; cleanup_info_wf' info; valid_mdb' s; valid_objs' s; pspace_aligned' s; untyped_ranges_zero' s; cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some k'; cte_lift k' = Some cte'\<rbrakk> \<Longrightarrow> ccap_relation (?cap3823 cleanupInfo s s' cte' k') (cte_C.cap_C k')
 2. \<And>cleanupInfo s s' cte' k'. \<lbrakk>(s, s') \<in> rf_sr; ccap_relation info cleanupInfo; cleanup_info_wf' info; valid_mdb' s; valid_objs' s; pspace_aligned' s; untyped_ranges_zero' s; cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some k'; cte_lift k' = Some cte'\<rbrakk> \<Longrightarrow> (?cap3823 cleanupInfo s s' cte' k' = capability.NullCap) = (cap_to_H (cap_CL cte') = capability.NullCap) proof (prove)
goal (2 subgoals):
 1. \<And>cleanupInfo s s' cte' k'. \<lbrakk>(s, s') \<in> rf_sr; ccap_relation info cleanupInfo; cleanup_info_wf' info; valid_mdb' s; valid_objs' s; pspace_aligned' s; untyped_ranges_zero' s; cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some k'; cte_lift k' = Some cte'\<rbrakk> \<Longrightarrow> ccte_relation (?cte3824 cleanupInfo s s' cte' k') k'
 2. \<And>cleanupInfo s s' cte' k'. \<lbrakk>(s, s') \<in> rf_sr; ccap_relation info cleanupInfo; cleanup_info_wf' info; valid_mdb' s; valid_objs' s; pspace_aligned' s; untyped_ranges_zero' s; cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some k'; cte_lift k' = Some cte'\<rbrakk> \<Longrightarrow> (cteCap (?cte3824 cleanupInfo s s' cte' k') = capability.NullCap) = (cap_to_H (cap_CL cte') = capability.NullCap) proof (prove)
goal (1 subgoal):
 1. \<And>cleanupInfo s s' cte' k'. \<lbrakk>(s, s') \<in> rf_sr; ccap_relation info cleanupInfo; cleanup_info_wf' info; valid_mdb' s; valid_objs' s; pspace_aligned' s; untyped_ranges_zero' s; cl_valid_cte cte'; cslift s' (cte_Ptr slot) = Some k'; cte_lift k' = Some cte'\<rbrakk> \<Longrightarrow> (cteCap (cte_to_H cte') = capability.NullCap) = (cap_to_H (cap_CL cte') = capability.NullCap) proof (prove)
goal:
No subgoals!