theory CNodeInv_R

lemma finaliseSlot_rvk_prog:
  "s \<turnstile> \<lbrace>\<lambda>s. revoke_progress_ord m (option_map capToRPO \<circ> cteCaps_of s)\<rbrace>
       finaliseSlot' slot e
   \<lbrace>\<lambda>rv s. revoke_progress_ord m (option_map capToRPO \<circ> cteCaps_of s)\<rbrace>,\<lbrace>\<top>\<top>\<rbrace>" proof (induct rule: finalise_induct3) case (1 sl ex st) show ?case apply (subst finaliseSlot'.simps) apply (unfold split_def) apply (rule hoare_pre_spec_validE) apply wp apply ((wp | simp)+)[1] apply (wp "1.hyps") apply (unfold Let_def split_def fst_conv
                        snd_conv haskell_fail_def
                        case_Zombie_assert_fold) apply (wp capSwap_rvk_prog | simp only: withoutPreemption_def)+ apply (wp preemptionPoint_inv)[1] apply force apply force apply (wp capSwap_rvk_prog | simp only: withoutPreemption_def)+ apply (wp getCTE_wp | simp)+ apply (rule hoare_strengthen_post [OF emptySlot_rvk_prog[where m=m]]) apply (clarsimp simp: cte_wp_at_ctes_of cteCaps_of_def o_def
                           dest!: isCapDs) apply (erule rpo_trans) apply (rule rvk_prog_modify_map[unfolded o_def]) apply (clarsimp simp: capToRPO_def) apply (rule spec_strengthen_postE,
                  rule "1.hyps", (assumption | rule refl)+) apply (clarsimp simp: cte_wp_at_ctes_of) apply (erule rpo_trans) apply (rule rvk_prog_modify_map[unfolded o_def]) apply (clarsimp simp: cteCaps_of_def capToRPO_def dest!: isCapDs) apply ((wp | simp add: locateSlot_conv)+)[2] apply (rule drop_spec_validE) apply simp apply (rule_tac Q="\<lambda>rv s. revoke_progress_ord m (option_map capToRPO \<circ> cteCaps_of s)
                                     \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) sl s"
                         in hoare_post_imp) apply (clarsimp simp: o_def cte_wp_at_ctes_of capToRPO_def
                        dest!: isCapDs) apply (simp split: capability.split_asm) apply (wp updateCap_cte_wp_at_cases | simp)+ apply (rule hoare_strengthen_post) apply (rule_tac Q="\<lambda>fc s. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s
                               \<and> revoke_progress_ord m (option_map capToRPO \<circ> cteCaps_of s)"
                   in hoare_vcg_conj_lift) apply (wp finaliseCap_rvk_prog'[folded o_def])[1] apply (rule finaliseCap_cases) apply (clarsimp simp: o_def cte_wp_at_ctes_of cteCaps_of_def) apply (strengthen imp_consequent, simp) apply (erule rpo_trans) apply (rule rvk_prog_modify_map[unfolded o_def]) apply (erule disjE, simp add: capRemovable_def) apply (auto dest!: isCapDs simp: capToRPO_def split: if_split if_split_asm)[1] apply (wp isFinalCapability_inv getCTE_wp | simp)+ apply (clarsimp simp: cte_wp_at_ctes_of o_def) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. s \<turnstile> \<lbrace>\<lambda>s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace> finaliseSlot' slot e \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace> proof (state)
goal (1 subgoal):
 1. \<And>x b s. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc xa xb y xaa xab xac v sa s'. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); xa = (fst rvb, b); (xb, y) = xa; \<not> (isZombie xb \<and> capZombieNumber xb = 0); \<not> (isZombie xb \<and> \<not> y); isZombie xb \<and> y; xaa = xb; xab = capZombiePtr xaa; xac = capZombieNumber xaa; (Inr v, s') \<in> fst ((withoutPreemption $ locateSlotCap xaa (fromIntegral (xac - 1))) sa)\<rbrakk> \<Longrightarrow> s' \<turnstile> \<lbrace>\<lambda>s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace> finaliseSlot' v False \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); (Inr rvd, std) \<in> fst ((let (v33, v34) = (fst rvb, b) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> x) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr x
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE x;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap x
od else haskell_assertE (ptr2 = x \<and> ptr \<noteq> x) [] else haskell_fail []
odE else haskell_fail []) stc); (Inr rve, ste) \<in> fst (preemptionPoint std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>\<lambda>s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>\<lambda>s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace> proof (state)
this:
\<lbrakk>(Inr ?rv, ?st) \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap ?rv); (Inr ?rva, ?sta) \<in> fst ((withoutPreemption $ isFinalCapability ?rv) ?st); (Inr ?rvb, ?stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap ?rv) ?rva False) ?sta); \<not> capRemovable (fst ?rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst ?rvb) sl); (Inr ?rvc, ?stc) \<in> fst ((withoutPreemption $ updateCap sl (fst ?rvb)) ?stb); ?xa = (fst ?rvb, ex); (?xb, ?y) = ?xa; \<not> (isZombie ?xb \<and> capZombieNumber ?xb = 0); \<not> (isZombie ?xb \<and> \<not> ?y); isZombie ?xb \<and> ?y; ?xaa = ?xb; ?xab = capZombiePtr ?xaa; ?xac = capZombieNumber ?xaa; (Inr ?v, ?s') \<in> fst ((withoutPreemption $ locateSlotCap ?xaa (fromIntegral (?xac - 1))) ?sa)\<rbrakk> \<Longrightarrow> ?s' \<turnstile> \<lbrace>\<lambda>s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace> finaliseSlot' ?v False \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
\<lbrakk>(Inr ?rv, ?st) \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap ?rv); (Inr ?rva, ?sta) \<in> fst ((withoutPreemption $ isFinalCapability ?rv) ?st); (Inr ?rvb, ?stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap ?rv) ?rva False) ?sta); \<not> capRemovable (fst ?rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst ?rvb) sl); (Inr ?rvc, ?stc) \<in> fst ((withoutPreemption $ updateCap sl (fst ?rvb)) ?stb); (Inr ?rvd, ?std) \<in> fst ((let (v33, v34) = (fst ?rvb, ex) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr sl
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE sl;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap sl
od else haskell_assertE (ptr2 = sl \<and> ptr \<noteq> sl) [] else haskell_fail []
odE else haskell_fail []) ?stc); (Inr ?rve, ?ste) \<in> fst (preemptionPoint ?std)\<rbrakk> \<Longrightarrow> ?ste \<turnstile> \<lbrace>\<lambda>s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace> finaliseSlot' sl ex \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>

goal (1 subgoal):
 1. \<And>x b s. \<lbrakk>\<And>rv st rva sta rvb stb rvc stc xa xb y xaa xab xac v sa s'. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); xa = (fst rvb, b); (xb, y) = xa; \<not> (isZombie xb \<and> capZombieNumber xb = 0); \<not> (isZombie xb \<and> \<not> y); isZombie xb \<and> y; xaa = xb; xab = capZombiePtr xaa; xac = capZombieNumber xaa; (Inr v, s') \<in> fst ((withoutPreemption $ locateSlotCap xaa (fromIntegral (xac - 1))) sa)\<rbrakk> \<Longrightarrow> s' \<turnstile> \<lbrace>\<lambda>s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace> finaliseSlot' v False \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>; \<And>rv st rva sta rvb stb rvc stc rvd std rve ste. \<lbrakk>(Inr rv, st) \<in> fst ((withoutPreemption $ getCTE x) s); \<not> (isNullCap $ cteCap rv); (Inr rva, sta) \<in> fst ((withoutPreemption $ isFinalCapability rv) st); (Inr rvb, stb) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) sta); \<not> capRemovable (fst rvb) x; \<not> (\<not> b \<and> capCyclicZombie (fst rvb) x); (Inr rvc, stc) \<in> fst ((withoutPreemption $ updateCap x (fst rvb)) stb); (Inr rvd, std) \<in> fst ((let (v33, v34) = (fst rvb, b) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> x) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr x
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE x;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap x
od else haskell_assertE (ptr2 = x \<and> ptr \<noteq> x) [] else haskell_fail []
odE else haskell_fail []) stc); (Inr rve, ste) \<in> fst (preemptionPoint std)\<rbrakk> \<Longrightarrow> ste \<turnstile> \<lbrace>\<lambda>s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>\<rbrakk> \<Longrightarrow> s \<turnstile> \<lbrace>\<lambda>s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace> finaliseSlot' x b \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace> proof (prove)
goal (1 subgoal):
 1. st \<turnstile> \<lbrace>\<lambda>s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace> finaliseSlot' sl ex \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace> proof (prove)
goal (1 subgoal):
 1. st \<turnstile> \<lbrace>\<lambda>s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace> doE cte <- withoutPreemption $ getCTE sl;
if isNullCap $ cteCap cte then returnOk (True, capability.NullCap) else doE final <- withoutPreemption $ isFinalCapability cte;
(remainder, info) <- withoutPreemption $ global.finaliseCap (cteCap cte) final False;
if capRemovable remainder sl then returnOk (True, info) else if \<not> ex \<and> capCyclicZombie remainder sl then doE withoutPreemption $ updateCap sl remainder;
returnOk (False, capability.NullCap)
odE else doE withoutPreemption $ updateCap sl remainder;
let (v33, v34) = (remainder, ex) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr sl
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE sl;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap sl
od else haskell_assertE (ptr2 = sl \<and> ptr \<noteq> sl) [] else haskell_fail []
odE else haskell_fail [];
preemptionPoint;
finaliseSlot' sl ex
odE
odE
odE \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace> proof (prove)
goal (1 subgoal):
 1. st \<turnstile> \<lbrace>\<lambda>s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace> doE cte <- withoutPreemption $ getCTE sl;
if isNullCap $ cteCap cte then returnOk (True, capability.NullCap) else doE final <- withoutPreemption $ isFinalCapability cte;
p <- withoutPreemption $ global.finaliseCap (cteCap cte) final False;
if capRemovable (fst p) sl then returnOk (True, snd p) else if \<not> ex \<and> capCyclicZombie (fst p) sl then doE withoutPreemption $ updateCap sl (fst p);
returnOk (False, capability.NullCap)
odE else doE withoutPreemption $ updateCap sl (fst p);
let p = (fst p, ex) in if isZombie (fst p) \<and> capZombieNumber (fst p) = 0 then haskell_fail [] else if isZombie (fst p) \<and> \<not> snd p then let ptr = capZombiePtr (fst p) in doE haskell_assertE (ptr \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr sl
odE else if isZombie (fst p) \<and> snd p then let z = fst p; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap sl
od else haskell_assertE (ptr2 = sl \<and> ptr \<noteq> sl) [] else haskell_fail []
odE else haskell_fail [];
preemptionPoint;
finaliseSlot' sl ex
odE
odE
odE \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace> proof (prove)
goal (2 subgoals):
 1. st \<turnstile> \<lbrace>?P'\<rbrace> doE cte <- withoutPreemption $ getCTE sl;
if isNullCap $ cteCap cte then returnOk (True, capability.NullCap) else doE final <- withoutPreemption $ isFinalCapability cte;
p <- withoutPreemption $ global.finaliseCap (cteCap cte) final False;
if capRemovable (fst p) sl then returnOk (True, snd p) else if \<not> ex \<and> capCyclicZombie (fst p) sl then doE withoutPreemption $ updateCap sl (fst p);
returnOk (False, capability.NullCap)
odE else doE withoutPreemption $ updateCap sl (fst p);
let p = (fst p, ex) in if isZombie (fst p) \<and> capZombieNumber (fst p) = 0 then haskell_fail [] else if isZombie (fst p) \<and> \<not> snd p then let ptr = capZombiePtr (fst p) in doE haskell_assertE (ptr \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr sl
odE else if isZombie (fst p) \<and> snd p then let z = fst p; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap sl
od else haskell_assertE (ptr2 = sl \<and> ptr \<noteq> sl) [] else haskell_fail []
odE else haskell_fail [];
preemptionPoint;
finaliseSlot' sl ex
odE
odE
odE \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> ex \<and> capCyclicZombie (fst rvb) sl\<rbrakk> \<Longrightarrow> \<lbrace>?P'50 rv s'' rva s''a rvb\<rbrace> withoutPreemption (updateCap sl (fst rvb)) \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, -
 2. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> doE withoutPreemption $ updateCap sl (fst rvb);
let p = (fst rvb, ex) in if isZombie (fst p) \<and> capZombieNumber (fst p) = 0 then haskell_fail [] else if isZombie (fst p) \<and> \<not> snd p then let ptr = capZombiePtr (fst p) in doE haskell_assertE (ptr \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr sl
odE else if isZombie (fst p) \<and> snd p then let z = fst p; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap sl
od else haskell_assertE (ptr2 = sl \<and> ptr \<noteq> sl) [] else haskell_fail []
odE else haskell_fail [];
preemptionPoint;
finaliseSlot' sl ex
odE \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> ?P'50 rv s'' rva s''a rvb s) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> doE withoutPreemption $ updateCap sl (fst rvb);
let p = (fst rvb, ex) in if isZombie (fst p) \<and> capZombieNumber (fst p) = 0 then haskell_fail [] else if isZombie (fst p) \<and> \<not> snd p then let ptr = capZombiePtr (fst p) in doE haskell_assertE (ptr \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr sl
odE else if isZombie (fst p) \<and> snd p then let z = fst p; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap sl
od else haskell_assertE (ptr2 = sl \<and> ptr \<noteq> sl) [] else haskell_fail []
odE else haskell_fail [];
preemptionPoint;
finaliseSlot' sl ex
odE \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (9 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d rve s''e. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); (Inr rvd, s''d) \<in> fst ((let p = (fst rvb, ex) in if isZombie (fst p) \<and> capZombieNumber (fst p) = 0 then haskell_fail [] else if isZombie (fst p) \<and> \<not> snd p then let ptr = capZombiePtr (fst p) in doE haskell_assertE (ptr \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr sl
odE else if isZombie (fst p) \<and> snd p then let z = fst p; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap sl
od else haskell_assertE (ptr2 = sl \<and> ptr \<noteq> sl) [] else haskell_fail []
odE else haskell_fail []) s''c); (Inr rve, s''e) \<in> fst (preemptionPoint s''d)\<rbrakk> \<Longrightarrow> (Inr (?rvd69 rv s'' rva s''a rvb s''b rvc s''c rvd s''d rve s''e), ?std69 rv s'' rva s''a rvb s''b rvc s''c rvd s''d rve s''e) \<in> fst ((let (v33, v34) = (fst rvb, ex) in if isZombie v33 \<and> capZombieNumber v33 = 0 then haskell_fail [] else if isZombie v33 \<and> \<not> v34 then let ptr = capZombiePtr v33 in doE haskell_assertE (ptr \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr sl
odE else if isZombie v33 \<and> v34 then let z = v33; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE (success, info) <- finaliseSlot' endSlot False;
whenE (False \<or> success) $ withoutPreemption $ emptySlot endSlot info
odE;
ourCTE <- withoutPreemption $ getCTE sl;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap sl
od else haskell_assertE (ptr2 = sl \<and> ptr \<noteq> sl) [] else haskell_fail []
odE else haskell_fail []) s''c)
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d rve s''e. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); (Inr rvd, s''d) \<in> fst ((let p = (fst rvb, ex) in if isZombie (fst p) \<and> capZombieNumber (fst p) = 0 then haskell_fail [] else if isZombie (fst p) \<and> \<not> snd p then let ptr = capZombiePtr (fst p) in doE haskell_assertE (ptr \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr sl
odE else if isZombie (fst p) \<and> snd p then let z = fst p; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap sl
od else haskell_assertE (ptr2 = sl \<and> ptr \<noteq> sl) [] else haskell_fail []
odE else haskell_fail []) s''c); (Inr rve, s''e) \<in> fst (preemptionPoint s''d)\<rbrakk> \<Longrightarrow> (Inr (?rve69 rv s'' rva s''a rvb s''b rvc s''c rvd s''d rve s''e), s''e) \<in> fst (preemptionPoint (?std69 rv s'' rva s''a rvb s''b rvc s''c rvd s''d rve s''e))
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); (Inr rvd, s''d) \<in> fst ((let p = (fst rvb, ex) in if isZombie (fst p) \<and> capZombieNumber (fst p) = 0 then haskell_fail [] else if isZombie (fst p) \<and> \<not> snd p then let ptr = capZombiePtr (fst p) in doE haskell_assertE (ptr \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr sl
odE else if isZombie (fst p) \<and> snd p then let z = fst p; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap sl
od else haskell_assertE (ptr2 = sl \<and> ptr \<noteq> sl) [] else haskell_fail []
odE else haskell_fail []) s''c)\<rbrakk> \<Longrightarrow> s''d \<turnstile> \<lbrace>?B65 rv s'' rva s''a rvb s''b rvc s''c rvd\<rbrace> preemptionPoint \<lbrace>\<lambda>rve s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?B63 rv s'' rva s''a rvb s''b rvc\<rbrace> let p = (fst rvb, ex) in if isZombie (fst p) \<and> capZombieNumber (fst p) = 0 then haskell_fail [] else if isZombie (fst p) \<and> \<not> snd p then let ptr = capZombiePtr (fst p) in doE haskell_assertE (ptr \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE ptr;
case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
withoutPreemption $ capSwapForDelete ptr sl
odE else if isZombie (fst p) \<and> snd p then let z = fst p; ptr = capZombiePtr z; n = capZombieNumber z in doE endSlot <- withoutPreemption $ locateSlotCap z (fromIntegral (n - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
let c2 = cteCap ourCTE in if isNullCap c2 then returnOk () else if isZombie c2 then let ptr2 = capZombiePtr c2 in if ptr = ptr2 \<and> capZombieNumber c2 = n \<and> capZombieType z = capZombieType c2 then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. n - 1) z) >>= updateCap sl
od else haskell_assertE (ptr2 = sl \<and> ptr \<noteq> sl) [] else haskell_fail []
odE else haskell_fail [] \<lbrace>?B65 rv s'' rva s''a rvb s''b rvc s''c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>?B63 rv s'' rva s''a rvb s''b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (9 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d rve s''e. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); (Inr rvd, s''d) \<in> fst ((if isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 then fail else if isZombie (fst rvb) \<and> \<not> ex then doE haskell_assertE (capZombiePtr (fst rvb) \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE (capZombiePtr (fst rvb));
assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> capZombiePtr (fst rvb));
withoutPreemption $ capSwapForDelete (capZombiePtr (fst rvb)) sl
odE else if isZombie (fst rvb) \<and> ex then doE endSlot <- withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
if isNullCap (cteCap ourCTE) then returnOk () else if isZombie (cteCap ourCTE) then if capZombiePtr (fst rvb) = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - 1) (fst rvb)) >>= updateCap sl
od else haskell_assertE (capZombiePtr (cteCap ourCTE) = sl \<and> capZombiePtr (fst rvb) \<noteq> sl) [] else fail
odE else fail) s''c); (Inr rve, s''e) \<in> fst (preemptionPoint s''d)\<rbrakk> \<Longrightarrow> (Inr (?rvd69 rv s'' rva s''a rvb s''b rvc s''c rvd s''d rve s''e), ?std69 rv s'' rva s''a rvb s''b rvc s''c rvd s''d rve s''e) \<in> fst ((if isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 then fail else if isZombie (fst rvb) \<and> \<not> ex then doE haskell_assertE (capZombiePtr (fst rvb) \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE (capZombiePtr (fst rvb));
assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> capZombiePtr (fst rvb));
withoutPreemption $ capSwapForDelete (capZombiePtr (fst rvb)) sl
odE else if isZombie (fst rvb) \<and> ex then doE endSlot <- withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
if isNullCap (cteCap ourCTE) then returnOk () else if isZombie (cteCap ourCTE) then if capZombiePtr (fst rvb) = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - 1) (fst rvb)) >>= updateCap sl
od else haskell_assertE (capZombiePtr (cteCap ourCTE) = sl \<and> capZombiePtr (fst rvb) \<noteq> sl) [] else fail
odE else fail) s''c)
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d rve s''e. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); (Inr rvd, s''d) \<in> fst ((if isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 then fail else if isZombie (fst rvb) \<and> \<not> ex then doE haskell_assertE (capZombiePtr (fst rvb) \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE (capZombiePtr (fst rvb));
assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> capZombiePtr (fst rvb));
withoutPreemption $ capSwapForDelete (capZombiePtr (fst rvb)) sl
odE else if isZombie (fst rvb) \<and> ex then doE endSlot <- withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
if isNullCap (cteCap ourCTE) then returnOk () else if isZombie (cteCap ourCTE) then if capZombiePtr (fst rvb) = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - 1) (fst rvb)) >>= updateCap sl
od else haskell_assertE (capZombiePtr (cteCap ourCTE) = sl \<and> capZombiePtr (fst rvb) \<noteq> sl) [] else fail
odE else fail) s''c); (Inr rve, s''e) \<in> fst (preemptionPoint s''d)\<rbrakk> \<Longrightarrow> (Inr (?rve69 rv s'' rva s''a rvb s''b rvc s''c rvd s''d rve s''e), s''e) \<in> fst (preemptionPoint (?std69 rv s'' rva s''a rvb s''b rvc s''c rvd s''d rve s''e))
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); (Inr rvd, s''d) \<in> fst ((if isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 then fail else if isZombie (fst rvb) \<and> \<not> ex then doE haskell_assertE (capZombiePtr (fst rvb) \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE (capZombiePtr (fst rvb));
assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> capZombiePtr (fst rvb));
withoutPreemption $ capSwapForDelete (capZombiePtr (fst rvb)) sl
odE else if isZombie (fst rvb) \<and> ex then doE endSlot <- withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
if isNullCap (cteCap ourCTE) then returnOk () else if isZombie (cteCap ourCTE) then if capZombiePtr (fst rvb) = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - 1) (fst rvb)) >>= updateCap sl
od else haskell_assertE (capZombiePtr (cteCap ourCTE) = sl \<and> capZombiePtr (fst rvb) \<noteq> sl) [] else fail
odE else fail) s''c)\<rbrakk> \<Longrightarrow> s''d \<turnstile> \<lbrace>?B65 rv s'' rva s''a rvb s''b rvc s''c rvd\<rbrace> preemptionPoint \<lbrace>\<lambda>rve s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?B63 rv s'' rva s''a rvb s''b rvc\<rbrace> if isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 then fail else if isZombie (fst rvb) \<and> \<not> ex then doE haskell_assertE (capZombiePtr (fst rvb) \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE (capZombiePtr (fst rvb));
assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> capZombiePtr (fst rvb));
withoutPreemption $ capSwapForDelete (capZombiePtr (fst rvb)) sl
odE else if isZombie (fst rvb) \<and> ex then doE endSlot <- withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
if isNullCap (cteCap ourCTE) then returnOk () else if isZombie (cteCap ourCTE) then if capZombiePtr (fst rvb) = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - 1) (fst rvb)) >>= updateCap sl
od else haskell_assertE (capZombiePtr (cteCap ourCTE) = sl \<and> capZombiePtr (fst rvb) \<noteq> sl) [] else fail
odE else fail \<lbrace>?B65 rv s'' rva s''a rvb s''b rvc s''c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>?B63 rv s'' rva s''a rvb s''b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst ((liftE $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((liftE $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((liftE $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((liftE $ updateCap sl (fst rvb)) s''b); (Inr rvd, s''d) \<in> fst ((if isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 then fail else if isZombie (fst rvb) \<and> \<not> ex then doE haskell_assertE (capZombiePtr (fst rvb) \<noteq> sl) [];
capAtPtr <- liftE $ liftM cteCap $ getCTE (capZombiePtr (fst rvb));
assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> capZombiePtr (fst rvb));
liftE $ capSwapForDelete (capZombiePtr (fst rvb)) sl
odE else if isZombie (fst rvb) \<and> ex then doE endSlot <- liftE $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ liftE $ emptySlot endSlot (snd p)
odE;
ourCTE <- liftE $ getCTE sl;
if isNullCap (cteCap ourCTE) then returnOk () else if isZombie (cteCap ourCTE) then if capZombiePtr (fst rvb) = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap ourCTE) then liftE $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - 1) (fst rvb)) >>= updateCap sl
od else haskell_assertE (capZombiePtr (cteCap ourCTE) = sl \<and> capZombiePtr (fst rvb) \<noteq> sl) [] else fail
odE else fail) s''c)\<rbrakk> \<Longrightarrow> \<lbrace>?P'75 rv s'' rva s''a rvb s''b rvc s''c rvd\<rbrace> preemptionPoint \<lbrace>\<lambda>rve s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, -
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?B63 rv s'' rva s''a rvb s''b rvc\<rbrace> if isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 then fail else if isZombie (fst rvb) \<and> \<not> ex then doE haskell_assertE (capZombiePtr (fst rvb) \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE (capZombiePtr (fst rvb));
assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> capZombiePtr (fst rvb));
withoutPreemption $ capSwapForDelete (capZombiePtr (fst rvb)) sl
odE else if isZombie (fst rvb) \<and> ex then doE endSlot <- withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
if isNullCap (cteCap ourCTE) then returnOk () else if isZombie (cteCap ourCTE) then if capZombiePtr (fst rvb) = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - 1) (fst rvb)) >>= updateCap sl
od else haskell_assertE (capZombiePtr (cteCap ourCTE) = sl \<and> capZombiePtr (fst rvb) \<noteq> sl) [] else fail
odE else fail \<lbrace>\<lambda>rvd s. True \<and> ?P'75 rv s'' rva s''a rvb s''b rvc s''c rvd s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>?B63 rv s'' rva s''a rvb s''b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (8 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d f s. \<lbrakk>(Inr rv, s'') \<in> fst ((liftE $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((liftE $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((liftE $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((liftE $ updateCap sl (fst rvb)) s''b); (Inr rvd, s''d) \<in> fst ((if isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 then fail else if isZombie (fst rvb) \<and> \<not> ex then doE haskell_assertE (capZombiePtr (fst rvb) \<noteq> sl) [];
capAtPtr <- liftE $ liftM cteCap $ getCTE (capZombiePtr (fst rvb));
assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> capZombiePtr (fst rvb));
liftE $ capSwapForDelete (capZombiePtr (fst rvb)) sl
odE else if isZombie (fst rvb) \<and> ex then doE endSlot <- liftE $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ liftE $ emptySlot endSlot (snd p)
odE;
ourCTE <- liftE $ getCTE sl;
if isNullCap (cteCap ourCTE) then returnOk () else if isZombie (cteCap ourCTE) then if capZombiePtr (fst rvb) = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap ourCTE) then liftE $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - 1) (fst rvb)) >>= updateCap sl
od else haskell_assertE (capZombiePtr (cteCap ourCTE) = sl \<and> capZombiePtr (fst rvb) \<noteq> sl) [] else fail
odE else fail) s''c)\<rbrakk> \<Longrightarrow> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of (ksWorkUnitsCompleted_update f s)) = revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst ((liftE $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((liftE $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((liftE $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((liftE $ updateCap sl (fst rvb)) s''b); (Inr rvd, s''d) \<in> fst ((if isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 then fail else if isZombie (fst rvb) \<and> \<not> ex then doE haskell_assertE (capZombiePtr (fst rvb) \<noteq> sl) [];
capAtPtr <- liftE $ liftM cteCap $ getCTE (capZombiePtr (fst rvb));
assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> capZombiePtr (fst rvb));
liftE $ capSwapForDelete (capZombiePtr (fst rvb)) sl
odE else if isZombie (fst rvb) \<and> ex then doE endSlot <- liftE $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ liftE $ emptySlot endSlot (snd p)
odE;
ourCTE <- liftE $ getCTE sl;
if isNullCap (cteCap ourCTE) then returnOk () else if isZombie (cteCap ourCTE) then if capZombiePtr (fst rvb) = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap ourCTE) then liftE $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - 1) (fst rvb)) >>= updateCap sl
od else haskell_assertE (capZombiePtr (cteCap ourCTE) = sl \<and> capZombiePtr (fst rvb) \<noteq> sl) [] else fail
odE else fail) s''c)\<rbrakk> \<Longrightarrow> irq_state_independent_H (\<lambda>s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s))
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?B63 rv s'' rva s''a rvb s''b rvc\<rbrace> if isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 then fail else if isZombie (fst rvb) \<and> \<not> ex then doE haskell_assertE (capZombiePtr (fst rvb) \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE (capZombiePtr (fst rvb));
assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> capZombiePtr (fst rvb));
withoutPreemption $ capSwapForDelete (capZombiePtr (fst rvb)) sl
odE else if isZombie (fst rvb) \<and> ex then doE endSlot <- withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
if isNullCap (cteCap ourCTE) then returnOk () else if isZombie (cteCap ourCTE) then if capZombiePtr (fst rvb) = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - 1) (fst rvb)) >>= updateCap sl
od else haskell_assertE (capZombiePtr (cteCap ourCTE) = sl \<and> capZombiePtr (fst rvb) \<noteq> sl) [] else fail
odE else fail \<lbrace>\<lambda>rvd s. True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>?B63 rv s'' rva s''a rvb s''b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst ((liftE $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((liftE $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((liftE $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((liftE $ updateCap sl (fst rvb)) s''b); (Inr rvd, s''d) \<in> fst ((if isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 then fail else if isZombie (fst rvb) \<and> \<not> ex then doE haskell_assertE (capZombiePtr (fst rvb) \<noteq> sl) [];
capAtPtr <- liftE $ liftM cteCap $ getCTE (capZombiePtr (fst rvb));
assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> capZombiePtr (fst rvb));
liftE $ capSwapForDelete (capZombiePtr (fst rvb)) sl
odE else if isZombie (fst rvb) \<and> ex then doE endSlot <- liftE $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ liftE $ emptySlot endSlot (snd p)
odE;
ourCTE <- liftE $ getCTE sl;
if isNullCap (cteCap ourCTE) then returnOk () else if isZombie (cteCap ourCTE) then if capZombiePtr (fst rvb) = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap ourCTE) then liftE $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - 1) (fst rvb)) >>= updateCap sl
od else haskell_assertE (capZombiePtr (cteCap ourCTE) = sl \<and> capZombiePtr (fst rvb) \<noteq> sl) [] else fail
odE else fail) s''c)\<rbrakk> \<Longrightarrow> irq_state_independent_H (\<lambda>s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s))
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?B63 rv s'' rva s''a rvb s''b rvc\<rbrace> if isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 then fail else if isZombie (fst rvb) \<and> \<not> ex then doE haskell_assertE (capZombiePtr (fst rvb) \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE (capZombiePtr (fst rvb));
assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> capZombiePtr (fst rvb));
withoutPreemption $ capSwapForDelete (capZombiePtr (fst rvb)) sl
odE else if isZombie (fst rvb) \<and> ex then doE endSlot <- withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
if isNullCap (cteCap ourCTE) then returnOk () else if isZombie (cteCap ourCTE) then if capZombiePtr (fst rvb) = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - 1) (fst rvb)) >>= updateCap sl
od else haskell_assertE (capZombiePtr (cteCap ourCTE) = sl \<and> capZombiePtr (fst rvb) \<noteq> sl) [] else fail
odE else fail \<lbrace>\<lambda>rvd s. True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>?B63 rv s'' rva s''a rvb s''b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?B63 rv s'' rva s''a rvb s''b rvc\<rbrace> if isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 then fail else if isZombie (fst rvb) \<and> \<not> ex then doE haskell_assertE (capZombiePtr (fst rvb) \<noteq> sl) [];
capAtPtr <- withoutPreemption $ liftM cteCap $ getCTE (capZombiePtr (fst rvb));
assertE (isZombie capAtPtr \<longrightarrow> capZombiePtr capAtPtr \<noteq> capZombiePtr (fst rvb));
withoutPreemption $ capSwapForDelete (capZombiePtr (fst rvb)) sl
odE else if isZombie (fst rvb) \<and> ex then doE endSlot <- withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
if isNullCap (cteCap ourCTE) then returnOk () else if isZombie (cteCap ourCTE) then if capZombiePtr (fst rvb) = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - 1) (fst rvb)) >>= updateCap sl
od else haskell_assertE (capZombiePtr (cteCap ourCTE) = sl \<and> capZombiePtr (fst rvb) \<noteq> sl) [] else fail
odE else fail \<lbrace>\<lambda>rvd s. True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>?B63 rv s'' rva s''a rvb s''b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (8 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst ((liftE $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((liftE $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((liftE $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> False \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((liftE $ updateCap sl (fst rvb)) s''b); \<not> (True \<and> capZombieNumber (fst rvb) = 0); isZombie (fst rvb) \<and> \<not> ex; (Inr rvd, s''d) \<in> fst (haskell_assertE (capZombiePtr (fst rvb) \<noteq> sl) [] s''c)\<rbrakk> \<Longrightarrow> \<lbrace>?P'140 rv s'' rva s''a rvb s''b rvc s''c rvd\<rbrace> getCTE (capZombiePtr (fst rvb)) \<lbrace>(\<lambda>a b. (isZombie a \<longrightarrow> capZombiePtr a \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl b \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) b) \<circ> cteCap\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); isZombie (fst rvb) \<and> \<not> ex\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P102 rv s'' rva s''a rvb s''b rvc\<rbrace> haskell_assertE (capZombiePtr (fst rvb) \<noteq> sl) [] \<lbrace>\<lambda>rvd s. True \<and> ?P'140 rv s'' rva s''a rvb s''b rvc s''c rvd s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P'104 rv s'' rva s''a rvb s''b rvc\<rbrace> if isZombie (fst rvb) \<and> ex then doE endSlot <- withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1));
doE p <- finaliseSlot' endSlot False;
whenE (False \<or> fst p) $ withoutPreemption $ emptySlot endSlot (snd p)
odE;
ourCTE <- withoutPreemption $ getCTE sl;
if isNullCap (cteCap ourCTE) then returnOk () else if isZombie (cteCap ourCTE) then if capZombiePtr (fst rvb) = capZombiePtr (cteCap ourCTE) \<and> capZombieNumber (cteCap ourCTE) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap ourCTE) then withoutPreemption $ do endCTE <- getCTE endSlot;
haskell_assert (isNullCap $ cteCap endCTE) [];
return (capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - 1) (fst rvb)) >>= updateCap sl
od else haskell_assertE (capZombiePtr (cteCap ourCTE) = sl \<and> capZombiePtr (fst rvb) \<noteq> sl) [] else fail
odE else fail \<lbrace>\<lambda>rvd s. True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 \<longrightarrow> True \<and> True) \<and> (\<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> ?P102 rv s'' rva s''a rvb s''b rvc s) \<and> (\<not> (isZombie (fst rvb) \<and> \<not> ex) \<longrightarrow> ?P'104 rv s'' rva s''a rvb s''b rvc s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (9 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b s''c rvd s''d rve s''e. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (rvb, s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable (fst rvb) sl; ((), s''c) \<in> fst (updateCap sl (fst rvb) s''b); 0 < capZombieNumber (fst rvb); isZombie (fst rvb) \<and> ex; (rvd, s''d) \<in> fst (locateSlotCap (fst rvb) (word_of_nat (capZombieNumber (fst rvb)) - 1) s''c); (Inr rve, s''e) \<in> fst ((doE cte <- liftE (getCTE rvd);
if cteCap cte = capability.NullCap then returnOk (True, capability.NullCap) else doE final <- liftE (isFinalCapability cte);
(remainder, info) <- liftE (global.finaliseCap (cteCap cte) final False);
if capRemovable remainder rvd then returnOk (True, info) else if capCyclicZombie remainder rvd then doE y <- liftE (updateCap rvd remainder);
returnOk (False, capability.NullCap)
odE else doE y <- liftE (updateCap rvd remainder);
y <- if isZombie remainder \<and> capZombieNumber remainder = 0 then fail else if isZombie remainder then let ptr = capZombiePtr remainder in doE y <- assertE (ptr \<noteq> rvd);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
liftE (capSwapForDelete ptr rvd)
odE else fail;
y <- preemptionPoint;
finaliseSlot' rvd False
odE
odE
odE) s''d); fst rve\<rbrakk> \<Longrightarrow> \<lbrace>?P'284 rv s'' rva s''a rvb s''b () s''c rvd s''d rve\<rbrace> emptySlot rvd (snd rve) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) sl s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) sl s \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a))) \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> (capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<and> capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>_. True) rvd s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) rvd s \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - Suc 0) (fst rvb)) a))))) \<and> ((capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<longrightarrow> capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<longrightarrow> capZombieType (fst rvb) \<noteq> capZombieType (cteCap cte)) \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a)))))\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c)\<rbrakk> \<Longrightarrow> s''d \<turnstile> \<lbrace>?B174 rv s'' rva s''a rvb s''b rvc s''c rvd\<rbrace> finaliseSlot' rvd False \<lbrace>\<lambda>a b. (False \<or> fst a \<longrightarrow> True \<and> True \<and> ?P'284 rv s'' rva s''a rvb s''b rvc s''c rvd s''d a b) \<and> (\<not> (False \<or> fst a) \<longrightarrow> True \<and> (cte_wp_at' (\<lambda>_. True) sl b \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) sl b \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of b a))) \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> (capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<and> capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>_. True) rvd b \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) rvd b \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of b) sl (\<lambda>a. capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - Suc 0) (fst rvb)) a))))) \<and> ((capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<longrightarrow> capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<longrightarrow> capZombieType (fst rvb) \<noteq> capZombieType (cteCap cte)) \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of b a)))))))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P171 rv s'' rva s''a rvb s''b rvc\<rbrace> withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) \<lbrace>?B174 rv s'' rva s''a rvb s''b rvc s''c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); \<not> (isZombie (fst rvb) \<and> ex)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P'173 rv s'' rva s''a rvb s''b rvc\<rbrace> fail \<lbrace>\<lambda>rvd s. True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 \<longrightarrow> True \<and> True) \<and> (\<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> True \<and> True \<and> (cte_wp_at' (\<lambda>_. True) (capZombiePtr (fst rvb)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (capZombiePtr (fst rvb)) s \<and> ((\<lambda>a b. (isZombie a \<longrightarrow> capZombiePtr a \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl b \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) b) \<circ> cteCap) cte s))) \<and> (\<not> (isZombie (fst rvb) \<and> \<not> ex) \<longrightarrow> (isZombie (fst rvb) \<and> ex \<longrightarrow> ?P171 rv s'' rva s''a rvb s''b rvc s) \<and> (\<not> (isZombie (fst rvb) \<and> ex) \<longrightarrow> ?P'173 rv s'' rva s''a rvb s''b rvc s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (9 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b s''c rvd s''d rve s''e rvc s. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (rvb, s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable (fst rvb) sl; ((), s''c) \<in> fst (updateCap sl (fst rvb) s''b); 0 < capZombieNumber (fst rvb); isZombie (fst rvb) \<and> ex; (rvd, s''d) \<in> fst (locateSlotCap (fst rvb) (word_of_nat (capZombieNumber (fst rvb)) - 1) s''c); (Inr rve, s''e) \<in> fst ((doE cte <- liftE (getCTE rvd);
if cteCap cte = capability.NullCap then returnOk (True, capability.NullCap) else doE final <- liftE (isFinalCapability cte);
(remainder, info) <- liftE (global.finaliseCap (cteCap cte) final False);
if capRemovable remainder rvd then returnOk (True, info) else if capCyclicZombie remainder rvd then doE y <- liftE (updateCap rvd remainder);
returnOk (False, capability.NullCap)
odE else doE y <- liftE (updateCap rvd remainder);
y <- if isZombie remainder \<and> capZombieNumber remainder = 0 then fail else if isZombie remainder then let ptr = capZombiePtr remainder in doE y <- assertE (ptr \<noteq> rvd);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
liftE (capSwapForDelete ptr rvd)
odE else fail;
y <- preemptionPoint;
finaliseSlot' rvd False
odE
odE
odE) s''d); fst rve; revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) sl s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) sl s \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a))) \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> (capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<and> capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>_. True) rvd s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) rvd s \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - Suc 0) (fst rvb)) a))))) \<and> ((capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<longrightarrow> capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<longrightarrow> capZombieType (fst rvb) \<noteq> capZombieType (cteCap cte)) \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a)))))
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c)\<rbrakk> \<Longrightarrow> s''d \<turnstile> \<lbrace>?B174 rv s'' rva s''a rvb s''b rvc s''c rvd\<rbrace> finaliseSlot' rvd False \<lbrace>\<lambda>a b. (False \<or> fst a \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b)) \<and> (\<not> (False \<or> fst a) \<longrightarrow> True \<and> (cte_wp_at' (\<lambda>_. True) sl b \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) sl b \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of b a))) \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> (capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<and> capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>_. True) rvd b \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) rvd b \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of b) sl (\<lambda>a. capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - Suc 0) (fst rvb)) a))))) \<and> ((capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<longrightarrow> capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<longrightarrow> capZombieType (fst rvb) \<noteq> capZombieType (cteCap cte)) \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of b a)))))))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P171 rv s'' rva s''a rvb s''b rvc\<rbrace> withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) \<lbrace>?B174 rv s'' rva s''a rvb s''b rvc s''c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); \<not> (isZombie (fst rvb) \<and> ex)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P'173 rv s'' rva s''a rvb s''b rvc\<rbrace> fail \<lbrace>\<lambda>rvd s. True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 \<longrightarrow> True \<and> True) \<and> (\<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> True \<and> True \<and> (cte_wp_at' (\<lambda>_. True) (capZombiePtr (fst rvb)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (capZombiePtr (fst rvb)) s \<and> ((\<lambda>a b. (isZombie a \<longrightarrow> capZombiePtr a \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl b \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) b) \<circ> cteCap) cte s))) \<and> (\<not> (isZombie (fst rvb) \<and> \<not> ex) \<longrightarrow> (isZombie (fst rvb) \<and> ex \<longrightarrow> ?P171 rv s'' rva s''a rvb s''b rvc s) \<and> (\<not> (isZombie (fst rvb) \<and> ex) \<longrightarrow> ?P'173 rv s'' rva s''a rvb s''b rvc s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (9 subgoals):
 1. \<And>rv s'' rva s''a b s''b s''c rvd s''d aa ba s''e s cte ptra bitsa numa ctea. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); ((capability.Zombie ptra bitsa numa, b), s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable (capability.Zombie ptra bitsa numa) sl; ((), s''c) \<in> fst (updateCap sl (capability.Zombie ptra bitsa numa) s''b); 0 < numa; (rvd, s''d) \<in> fst (locateSlotCap (capability.Zombie ptra bitsa numa) (word_of_nat numa - 1) s''c); (Inr (True, ba), s''e) \<in> fst ((doE cte <- liftE (getCTE rvd);
if cteCap cte = capability.NullCap then returnOk (True, capability.NullCap) else doE final <- liftE (isFinalCapability cte);
(remainder, info) <- liftE (global.finaliseCap (cteCap cte) final False);
if capRemovable remainder rvd then returnOk (True, info) else if capCyclicZombie remainder rvd then doE y <- liftE (updateCap rvd remainder);
returnOk (False, capability.NullCap)
odE else doE y <- liftE (updateCap rvd remainder);
y <- if isZombie remainder \<and> capZombieNumber remainder = 0 then fail else if isZombie remainder then let ptr = capZombiePtr remainder in doE y <- assertE (ptr \<noteq> rvd);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
liftE (capSwapForDelete ptr rvd)
odE else fail;
y <- preemptionPoint;
finaliseSlot' rvd False
odE
odE
odE) s''d); aa; revoke_progress_ord m (\<lambda>x. map_option capToRPO (map_option cteCap (ctes_of s x))); ex; ctes_of s sl = Some cte; cteCap cte = capability.Zombie ptra bitsa numa; ctes_of s rvd = Some ctea; cteCap ctea = capability.NullCap\<rbrakk> \<Longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (\<lambda>x. map_option cteCap (ctes_of s x)) sl (\<lambda>a. capability.Zombie ptra bitsa (numa - Suc 0)) a))
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c)\<rbrakk> \<Longrightarrow> s''d \<turnstile> \<lbrace>?B174 rv s'' rva s''a rvb s''b rvc s''c rvd\<rbrace> finaliseSlot' rvd False \<lbrace>\<lambda>a b. (False \<or> fst a \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b)) \<and> (\<not> (False \<or> fst a) \<longrightarrow> True \<and> (cte_wp_at' (\<lambda>_. True) sl b \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) sl b \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of b a))) \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> (capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<and> capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>_. True) rvd b \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) rvd b \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of b) sl (\<lambda>a. capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - Suc 0) (fst rvb)) a))))) \<and> ((capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<longrightarrow> capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<longrightarrow> capZombieType (fst rvb) \<noteq> capZombieType (cteCap cte)) \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of b a)))))))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P171 rv s'' rva s''a rvb s''b rvc\<rbrace> withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) \<lbrace>?B174 rv s'' rva s''a rvb s''b rvc s''c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); \<not> (isZombie (fst rvb) \<and> ex)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P'173 rv s'' rva s''a rvb s''b rvc\<rbrace> fail \<lbrace>\<lambda>rvd s. True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 \<longrightarrow> True \<and> True) \<and> (\<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> True \<and> True \<and> (cte_wp_at' (\<lambda>_. True) (capZombiePtr (fst rvb)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (capZombiePtr (fst rvb)) s \<and> ((\<lambda>a b. (isZombie a \<longrightarrow> capZombiePtr a \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl b \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) b) \<circ> cteCap) cte s))) \<and> (\<not> (isZombie (fst rvb) \<and> \<not> ex) \<longrightarrow> (isZombie (fst rvb) \<and> ex \<longrightarrow> ?P171 rv s'' rva s''a rvb s''b rvc s) \<and> (\<not> (isZombie (fst rvb) \<and> ex) \<longrightarrow> ?P'173 rv s'' rva s''a rvb s''b rvc s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (9 subgoals):
 1. \<And>rv s'' rva s''a b s''b s''c rvd s''d aa ba s''e s cte ptra bitsa numa ctea. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); ((capability.Zombie ptra bitsa numa, b), s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable (capability.Zombie ptra bitsa numa) sl; ((), s''c) \<in> fst (updateCap sl (capability.Zombie ptra bitsa numa) s''b); 0 < numa; (rvd, s''d) \<in> fst (locateSlotCap (capability.Zombie ptra bitsa numa) (word_of_nat numa - 1) s''c); (Inr (True, ba), s''e) \<in> fst ((doE cte <- liftE (getCTE rvd);
if cteCap cte = capability.NullCap then returnOk (True, capability.NullCap) else doE final <- liftE (isFinalCapability cte);
(remainder, info) <- liftE (global.finaliseCap (cteCap cte) final False);
if capRemovable remainder rvd then returnOk (True, info) else if capCyclicZombie remainder rvd then doE y <- liftE (updateCap rvd remainder);
returnOk (False, capability.NullCap)
odE else doE y <- liftE (updateCap rvd remainder);
y <- if isZombie remainder \<and> capZombieNumber remainder = 0 then fail else if isZombie remainder then let ptr = capZombiePtr remainder in doE y <- assertE (ptr \<noteq> rvd);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
liftE (capSwapForDelete ptr rvd)
odE else fail;
y <- preemptionPoint;
finaliseSlot' rvd False
odE
odE
odE) s''d); aa; ex; ctes_of s sl = Some cte; cteCap cte = capability.Zombie ptra bitsa numa; ctes_of s rvd = Some ctea; cteCap ctea = capability.NullCap\<rbrakk> \<Longrightarrow> revoke_progress_ord (\<lambda>x. map_option capToRPO (map_option cteCap (ctes_of s x))) (\<lambda>a. map_option capToRPO (modify_map (\<lambda>x. map_option cteCap (ctes_of s x)) sl (\<lambda>a. capability.Zombie ptra bitsa (numa - Suc 0)) a))
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c)\<rbrakk> \<Longrightarrow> s''d \<turnstile> \<lbrace>?B174 rv s'' rva s''a rvb s''b rvc s''c rvd\<rbrace> finaliseSlot' rvd False \<lbrace>\<lambda>a b. (False \<or> fst a \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b)) \<and> (\<not> (False \<or> fst a) \<longrightarrow> True \<and> (cte_wp_at' (\<lambda>_. True) sl b \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) sl b \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of b a))) \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> (capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<and> capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>_. True) rvd b \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) rvd b \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of b) sl (\<lambda>a. capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - Suc 0) (fst rvb)) a))))) \<and> ((capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<longrightarrow> capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<longrightarrow> capZombieType (fst rvb) \<noteq> capZombieType (cteCap cte)) \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of b a)))))))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P171 rv s'' rva s''a rvb s''b rvc\<rbrace> withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) \<lbrace>?B174 rv s'' rva s''a rvb s''b rvc s''c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); \<not> (isZombie (fst rvb) \<and> ex)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P'173 rv s'' rva s''a rvb s''b rvc\<rbrace> fail \<lbrace>\<lambda>rvd s. True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 \<longrightarrow> True \<and> True) \<and> (\<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> True \<and> True \<and> (cte_wp_at' (\<lambda>_. True) (capZombiePtr (fst rvb)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (capZombiePtr (fst rvb)) s \<and> ((\<lambda>a b. (isZombie a \<longrightarrow> capZombiePtr a \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl b \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) b) \<circ> cteCap) cte s))) \<and> (\<not> (isZombie (fst rvb) \<and> \<not> ex) \<longrightarrow> (isZombie (fst rvb) \<and> ex \<longrightarrow> ?P171 rv s'' rva s''a rvb s''b rvc s) \<and> (\<not> (isZombie (fst rvb) \<and> ex) \<longrightarrow> ?P'173 rv s'' rva s''a rvb s''b rvc s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (9 subgoals):
 1. \<And>rv s'' rva s''a b s''b s''c rvd s''d aa ba s''e s cte ptra bitsa numa ctea x. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); ((capability.Zombie ptra bitsa numa, b), s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable (capability.Zombie ptra bitsa numa) sl; ((), s''c) \<in> fst (updateCap sl (capability.Zombie ptra bitsa numa) s''b); 0 < numa; (rvd, s''d) \<in> fst (locateSlotCap (capability.Zombie ptra bitsa numa) (word_of_nat numa - 1) s''c); (Inr (True, ba), s''e) \<in> fst ((doE cte <- liftE (getCTE rvd);
if cteCap cte = capability.NullCap then returnOk (True, capability.NullCap) else doE final <- liftE (isFinalCapability cte);
(remainder, info) <- liftE (global.finaliseCap (cteCap cte) final False);
if capRemovable remainder rvd then returnOk (True, info) else if capCyclicZombie remainder rvd then doE y <- liftE (updateCap rvd remainder);
returnOk (False, capability.NullCap)
odE else doE y <- liftE (updateCap rvd remainder);
y <- if isZombie remainder \<and> capZombieNumber remainder = 0 then fail else if isZombie remainder then let ptr = capZombiePtr remainder in doE y <- assertE (ptr \<noteq> rvd);
capAtPtr <- liftE (liftM cteCap (getCTE ptr));
y <- case capAtPtr of capability.Zombie ptr2 x xa \<Rightarrow> haskell_assertE (ptr2 \<noteq> ptr) [] | _ \<Rightarrow> returnOk ();
liftE (capSwapForDelete ptr rvd)
odE else fail;
y <- preemptionPoint;
finaliseSlot' rvd False
odE
odE
odE) s''d); aa; ex; ctes_of s sl = Some cte; cteCap cte = capability.Zombie ptra bitsa numa; ctes_of s rvd = Some ctea; cteCap ctea = capability.NullCap; Some x = map_option cteCap (ctes_of s sl)\<rbrakk> \<Longrightarrow> capToRPO (capability.Zombie ptra bitsa (numa - Suc 0)) = capToRPO x \<or> rpo_measure sl (Some (capToRPO (capability.Zombie ptra bitsa (numa - Suc 0)))) < rpo_measure sl (Some (capToRPO x))
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c)\<rbrakk> \<Longrightarrow> s''d \<turnstile> \<lbrace>?B174 rv s'' rva s''a rvb s''b rvc s''c rvd\<rbrace> finaliseSlot' rvd False \<lbrace>\<lambda>a b. (False \<or> fst a \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b)) \<and> (\<not> (False \<or> fst a) \<longrightarrow> True \<and> (cte_wp_at' (\<lambda>_. True) sl b \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) sl b \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of b a))) \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> (capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<and> capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>_. True) rvd b \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) rvd b \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of b) sl (\<lambda>a. capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - Suc 0) (fst rvb)) a))))) \<and> ((capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<longrightarrow> capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<longrightarrow> capZombieType (fst rvb) \<noteq> capZombieType (cteCap cte)) \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of b a)))))))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P171 rv s'' rva s''a rvb s''b rvc\<rbrace> withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) \<lbrace>?B174 rv s'' rva s''a rvb s''b rvc s''c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); \<not> (isZombie (fst rvb) \<and> ex)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P'173 rv s'' rva s''a rvb s''b rvc\<rbrace> fail \<lbrace>\<lambda>rvd s. True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 \<longrightarrow> True \<and> True) \<and> (\<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> True \<and> True \<and> (cte_wp_at' (\<lambda>_. True) (capZombiePtr (fst rvb)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (capZombiePtr (fst rvb)) s \<and> ((\<lambda>a b. (isZombie a \<longrightarrow> capZombiePtr a \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl b \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) b) \<circ> cteCap) cte s))) \<and> (\<not> (isZombie (fst rvb) \<and> \<not> ex) \<longrightarrow> (isZombie (fst rvb) \<and> ex \<longrightarrow> ?P171 rv s'' rva s''a rvb s''b rvc s) \<and> (\<not> (isZombie (fst rvb) \<and> ex) \<longrightarrow> ?P'173 rv s'' rva s''a rvb s''b rvc s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (8 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c)\<rbrakk> \<Longrightarrow> s''d \<turnstile> \<lbrace>?B174 rv s'' rva s''a rvb s''b rvc s''c rvd\<rbrace> finaliseSlot' rvd False \<lbrace>\<lambda>a b. (False \<or> fst a \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b)) \<and> (\<not> (False \<or> fst a) \<longrightarrow> True \<and> (cte_wp_at' (\<lambda>_. True) sl b \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) sl b \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of b a))) \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> (capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<and> capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>_. True) rvd b \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) rvd b \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of b) sl (\<lambda>a. capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - Suc 0) (fst rvb)) a))))) \<and> ((capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<longrightarrow> capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<longrightarrow> capZombieType (fst rvb) \<noteq> capZombieType (cteCap cte)) \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of b a)))))))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P171 rv s'' rva s''a rvb s''b rvc\<rbrace> withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) \<lbrace>?B174 rv s'' rva s''a rvb s''b rvc s''c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); \<not> (isZombie (fst rvb) \<and> ex)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P'173 rv s'' rva s''a rvb s''b rvc\<rbrace> fail \<lbrace>\<lambda>rvd s. True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 \<longrightarrow> True \<and> True) \<and> (\<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> True \<and> True \<and> (cte_wp_at' (\<lambda>_. True) (capZombiePtr (fst rvb)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (capZombiePtr (fst rvb)) s \<and> ((\<lambda>a b. (isZombie a \<longrightarrow> capZombiePtr a \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl b \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) b) \<circ> cteCap) cte s))) \<and> (\<not> (isZombie (fst rvb) \<and> \<not> ex) \<longrightarrow> (isZombie (fst rvb) \<and> ex \<longrightarrow> ?P171 rv s'' rva s''a rvb s''b rvc s) \<and> (\<not> (isZombie (fst rvb) \<and> ex) \<longrightarrow> ?P'173 rv s'' rva s''a rvb s''b rvc s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (8 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c rvd s''d s r. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex; (Inr rvd, s''d) \<in> fst ((withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1))) s''c); revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of r)\<rbrakk> \<Longrightarrow> (False \<or> fst s \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of r)) \<and> (\<not> (False \<or> fst s) \<longrightarrow> True \<and> (cte_wp_at' (\<lambda>_. True) sl r \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) sl r \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of r a))) \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> isZombie (cteCap cte) \<longrightarrow> (capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<and> capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<and> capZombieType (fst rvb) = capZombieType (cteCap cte) \<longrightarrow> cte_wp_at' (\<lambda>_. True) rvd r \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) rvd r \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of r) sl (\<lambda>a. capZombieNumber_update (\<lambda>_. capZombieNumber (fst rvb) - Suc 0) (fst rvb)) a))))) \<and> ((capZombieNumber (cteCap cte) = capZombieNumber (fst rvb) \<longrightarrow> capZombiePtr (fst rvb) = capZombiePtr (cteCap cte) \<longrightarrow> capZombieType (fst rvb) \<noteq> capZombieType (cteCap cte)) \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of r a)))))))
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P171 rv s'' rva s''a rvb s''b rvc\<rbrace> withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) \<lbrace>\<lambda>rvd s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); \<not> (isZombie (fst rvb) \<and> ex)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P'173 rv s'' rva s''a rvb s''b rvc\<rbrace> fail \<lbrace>\<lambda>rvd s. True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 \<longrightarrow> True \<and> True) \<and> (\<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> True \<and> True \<and> (cte_wp_at' (\<lambda>_. True) (capZombiePtr (fst rvb)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (capZombiePtr (fst rvb)) s \<and> ((\<lambda>a b. (isZombie a \<longrightarrow> capZombiePtr a \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl b \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) b) \<circ> cteCap) cte s))) \<and> (\<not> (isZombie (fst rvb) \<and> \<not> ex) \<longrightarrow> (isZombie (fst rvb) \<and> ex \<longrightarrow> ?P171 rv s'' rva s''a rvb s''b rvc s) \<and> (\<not> (isZombie (fst rvb) \<and> ex) \<longrightarrow> ?P'173 rv s'' rva s''a rvb s''b rvc s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (8 subgoals):
 1. \<And>rv s'' rva s''a a b s''b s''c rvd s''d aa r cte ctea. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); ((a, b), s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable a sl; ((), s''c) \<in> fst (updateCap sl a s''b); 0 < capZombieNumber a; (rvd, s''d) \<in> fst (locateSlotCap a (word_of_nat (capZombieNumber a) - 1) s''c); revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of r a)); isZombie a; ex; \<not> aa; ctes_of r sl = Some cte; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); capZombiePtr a = capZombiePtr (cteCap cte); capZombieNumber (cteCap cte) = capZombieNumber a; capZombieType a = capZombieType (cteCap cte); ctes_of r rvd = Some ctea; cteCap ctea = capability.NullCap\<rbrakk> \<Longrightarrow> revoke_progress_ord m (\<lambda>b. map_option capToRPO (modify_map (cteCaps_of r) sl (\<lambda>b. capZombieNumber_update (\<lambda>_. capZombieNumber a - Suc 0) a) b))
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P171 rv s'' rva s''a rvb s''b rvc\<rbrace> withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) \<lbrace>\<lambda>rvd s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); \<not> (isZombie (fst rvb) \<and> ex)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P'173 rv s'' rva s''a rvb s''b rvc\<rbrace> fail \<lbrace>\<lambda>rvd s. True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 \<longrightarrow> True \<and> True) \<and> (\<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> True \<and> True \<and> (cte_wp_at' (\<lambda>_. True) (capZombiePtr (fst rvb)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (capZombiePtr (fst rvb)) s \<and> ((\<lambda>a b. (isZombie a \<longrightarrow> capZombiePtr a \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl b \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) b) \<circ> cteCap) cte s))) \<and> (\<not> (isZombie (fst rvb) \<and> \<not> ex) \<longrightarrow> (isZombie (fst rvb) \<and> ex \<longrightarrow> ?P171 rv s'' rva s''a rvb s''b rvc s) \<and> (\<not> (isZombie (fst rvb) \<and> ex) \<longrightarrow> ?P'173 rv s'' rva s''a rvb s''b rvc s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (8 subgoals):
 1. \<And>rv s'' rva s''a a b s''b s''c rvd s''d aa r cte ctea. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); ((a, b), s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable a sl; ((), s''c) \<in> fst (updateCap sl a s''b); 0 < capZombieNumber a; (rvd, s''d) \<in> fst (locateSlotCap a (word_of_nat (capZombieNumber a) - 1) s''c); isZombie a; ex; \<not> aa; ctes_of r sl = Some cte; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); capZombiePtr a = capZombiePtr (cteCap cte); capZombieNumber (cteCap cte) = capZombieNumber a; capZombieType a = capZombieType (cteCap cte); ctes_of r rvd = Some ctea; cteCap ctea = capability.NullCap\<rbrakk> \<Longrightarrow> revoke_progress_ord (\<lambda>a. map_option capToRPO (cteCaps_of r a)) (\<lambda>b. map_option capToRPO (modify_map (cteCaps_of r) sl (\<lambda>b. capZombieNumber_update (\<lambda>_. capZombieNumber a - Suc 0) a) b))
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P171 rv s'' rva s''a rvb s''b rvc\<rbrace> withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) \<lbrace>\<lambda>rvd s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); \<not> (isZombie (fst rvb) \<and> ex)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P'173 rv s'' rva s''a rvb s''b rvc\<rbrace> fail \<lbrace>\<lambda>rvd s. True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 \<longrightarrow> True \<and> True) \<and> (\<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> True \<and> True \<and> (cte_wp_at' (\<lambda>_. True) (capZombiePtr (fst rvb)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (capZombiePtr (fst rvb)) s \<and> ((\<lambda>a b. (isZombie a \<longrightarrow> capZombiePtr a \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl b \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) b) \<circ> cteCap) cte s))) \<and> (\<not> (isZombie (fst rvb) \<and> \<not> ex) \<longrightarrow> (isZombie (fst rvb) \<and> ex \<longrightarrow> ?P171 rv s'' rva s''a rvb s''b rvc s) \<and> (\<not> (isZombie (fst rvb) \<and> ex) \<longrightarrow> ?P'173 rv s'' rva s''a rvb s''b rvc s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (8 subgoals):
 1. \<And>rv s'' rva s''a a b s''b s''c rvd s''d aa r cte ctea x. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); ((a, b), s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable a sl; ((), s''c) \<in> fst (updateCap sl a s''b); 0 < capZombieNumber a; (rvd, s''d) \<in> fst (locateSlotCap a (word_of_nat (capZombieNumber a) - 1) s''c); isZombie a; ex; \<not> aa; ctes_of r sl = Some cte; cteCap cte \<noteq> capability.NullCap; isZombie (cteCap cte); capZombiePtr a = capZombiePtr (cteCap cte); capZombieNumber (cteCap cte) = capZombieNumber a; capZombieType a = capZombieType (cteCap cte); ctes_of r rvd = Some ctea; cteCap ctea = capability.NullCap; Some x = cteCaps_of r sl\<rbrakk> \<Longrightarrow> capToRPO (capZombieNumber_update (\<lambda>_. capZombieNumber a - Suc 0) a) = capToRPO x \<or> rpo_measure sl (Some (capToRPO (capZombieNumber_update (\<lambda>_. capZombieNumber a - Suc 0) a))) < rpo_measure sl (Some (capToRPO x))
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P171 rv s'' rva s''a rvb s''b rvc\<rbrace> withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) \<lbrace>\<lambda>rvd s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); \<not> (isZombie (fst rvb) \<and> ex)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P'173 rv s'' rva s''a rvb s''b rvc\<rbrace> fail \<lbrace>\<lambda>rvd s. True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 \<longrightarrow> True \<and> True) \<and> (\<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> True \<and> True \<and> (cte_wp_at' (\<lambda>_. True) (capZombiePtr (fst rvb)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (capZombiePtr (fst rvb)) s \<and> ((\<lambda>a b. (isZombie a \<longrightarrow> capZombiePtr a \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl b \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) b) \<circ> cteCap) cte s))) \<and> (\<not> (isZombie (fst rvb) \<and> \<not> ex) \<longrightarrow> (isZombie (fst rvb) \<and> ex \<longrightarrow> ?P171 rv s'' rva s''a rvb s''b rvc s) \<and> (\<not> (isZombie (fst rvb) \<and> ex) \<longrightarrow> ?P'173 rv s'' rva s''a rvb s''b rvc s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (7 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); isZombie (fst rvb) \<and> ex\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P171 rv s'' rva s''a rvb s''b rvc\<rbrace> withoutPreemption $ locateSlotCap (fst rvb) (fromIntegral (capZombieNumber (fst rvb) - 1)) \<lbrace>\<lambda>rvd s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>rv s'' rva s''a rvb s''b rvc s''c. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl); (Inr rvc, s''c) \<in> fst ((withoutPreemption $ updateCap sl (fst rvb)) s''b); \<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0); \<not> (isZombie (fst rvb) \<and> \<not> ex); \<not> (isZombie (fst rvb) \<and> ex)\<rbrakk> \<Longrightarrow> s''c \<turnstile> \<lbrace>?P'173 rv s'' rva s''a rvb s''b rvc\<rbrace> fail \<lbrace>\<lambda>rvd s. True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 \<longrightarrow> True \<and> True) \<and> (\<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> True \<and> True \<and> (cte_wp_at' (\<lambda>_. True) (capZombiePtr (fst rvb)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (capZombiePtr (fst rvb)) s \<and> ((\<lambda>a b. (isZombie a \<longrightarrow> capZombiePtr a \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of b) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl b \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) b) \<circ> cteCap) cte s))) \<and> (\<not> (isZombie (fst rvb) \<and> \<not> ex) \<longrightarrow> (isZombie (fst rvb) \<and> ex \<longrightarrow> ?P171 rv s'' rva s''a rvb s''b rvc s) \<and> (\<not> (isZombie (fst rvb) \<and> ex) \<longrightarrow> ?P'173 rv s'' rva s''a rvb s''b rvc s)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> s''b \<turnstile> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 \<longrightarrow> True \<and> True) \<and> (\<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> True \<and> True \<and> (cte_wp_at' (\<lambda>_. True) (capZombiePtr (fst rvb)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (capZombiePtr (fst rvb)) s \<and> ((\<lambda>a aa. (isZombie a \<longrightarrow> capZombiePtr a \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of aa) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl aa \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) aa) \<circ> cteCap) cte s))) \<and> (\<not> (isZombie (fst rvb) \<and> \<not> ex) \<longrightarrow> (isZombie (fst rvb) \<and> ex \<longrightarrow> True \<and> ((isCNodeCap (fst rvb) \<or> capZombieType (fst rvb) \<noteq> ZombieTCB) \<and> (case gsCNodes s (global.capUntypedPtr (fst rvb)) of None \<Rightarrow> False | Some n \<Rightarrow> (isCNodeCap (fst rvb) \<and> n = capCNodeBits (fst rvb) \<or> n = zombieCTEBits (capZombieType (fst rvb))) \<and> word_of_nat (capZombieNumber (fst rvb)) - 1 < 2 ^ n) \<or> isThreadCap (fst rvb) \<or> capZombieType (fst rvb) = ZombieTCB \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a)))) \<and> (\<not> (isZombie (fst rvb) \<and> ex) \<longrightarrow> True \<and> True)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s''); (Inr rvb, s''b) \<in> fst ((withoutPreemption $ global.finaliseCap (cteCap rv) rva False) s''a); \<not> capRemovable (fst rvb) sl; \<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl)\<rbrakk> \<Longrightarrow> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> withoutPreemption $ updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0 \<longrightarrow> True \<and> True) \<and> (\<not> (isZombie (fst rvb) \<and> capZombieNumber (fst rvb) = 0) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> True \<and> True \<and> (cte_wp_at' (\<lambda>_. True) (capZombiePtr (fst rvb)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (capZombiePtr (fst rvb)) s \<and> ((\<lambda>a aa. (isZombie a \<longrightarrow> capZombiePtr a \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of aa) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl aa \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) aa) \<circ> cteCap) cte s))) \<and> (\<not> (isZombie (fst rvb) \<and> \<not> ex) \<longrightarrow> (isZombie (fst rvb) \<and> ex \<longrightarrow> True \<and> ((isCNodeCap (fst rvb) \<or> capZombieType (fst rvb) \<noteq> ZombieTCB) \<and> (case gsCNodes s (global.capUntypedPtr (fst rvb)) of None \<Rightarrow> False | Some n \<Rightarrow> (isCNodeCap (fst rvb) \<and> n = capCNodeBits (fst rvb) \<or> n = zombieCTEBits (capZombieType (fst rvb))) \<and> word_of_nat (capZombieNumber (fst rvb)) - 1 < 2 ^ n) \<or> isThreadCap (fst rvb) \<or> capZombieType (fst rvb) = ZombieTCB \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a)))) \<and> (\<not> (isZombie (fst rvb) \<and> ex) \<longrightarrow> True \<and> True)))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (rvb, s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable (fst rvb) sl; ex \<or> \<not> capCyclicZombie (fst rvb) sl\<rbrakk> \<Longrightarrow> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> updateCap sl (fst rvb) \<lbrace>\<lambda>rvc s. (isZombie (fst rvb) \<longrightarrow> 0 < capZombieNumber (fst rvb)) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capZombiePtr (fst rvb)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (capZombiePtr (fst rvb)) s \<and> ((isZombie (cteCap cte) \<longrightarrow> capZombiePtr (cteCap cte) \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a)) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl s \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) s))) \<and> ((isZombie (fst rvb) \<longrightarrow> ex) \<longrightarrow> isZombie (fst rvb) \<and> ex \<longrightarrow> ((isCNodeCap (fst rvb) \<or> capZombieType (fst rvb) \<noteq> ZombieTCB) \<and> (case gsCNodes s (global.capUntypedPtr (fst rvb)) of None \<Rightarrow> False | Some n \<Rightarrow> (isCNodeCap (fst rvb) \<and> n = capCNodeBits (fst rvb) \<or> n = zombieCTEBits (capZombieType (fst rvb))) \<and> word_of_nat (capZombieNumber (fst rvb)) - 1 < 2 ^ n) \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a))) \<and> (isThreadCap (fst rvb) \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a))) \<and> (capZombieType (fst rvb) = ZombieTCB \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a))))\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b rvc s. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (rvb, s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable (fst rvb) sl; ex \<or> \<not> capCyclicZombie (fst rvb) sl; revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) sl s\<rbrakk> \<Longrightarrow> (isZombie (fst rvb) \<longrightarrow> 0 < capZombieNumber (fst rvb)) \<longrightarrow> (isZombie (fst rvb) \<and> \<not> ex \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capZombiePtr (fst rvb)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (capZombiePtr (fst rvb)) s \<and> ((isZombie (cteCap cte) \<longrightarrow> capZombiePtr (cteCap cte) \<noteq> capZombiePtr (fst rvb)) \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a)) \<and> cte_wp_at' (\<lambda>cte. \<exists>n. capToRPO (cteCap cte) = (Some (capZombiePtr (fst rvb)), Suc n)) sl s \<and> cte_wp_at' (\<lambda>cte. fst (capToRPO (cteCap cte)) \<noteq> Some (capZombiePtr (fst rvb))) (capZombiePtr (fst rvb)) s))) \<and> ((isZombie (fst rvb) \<longrightarrow> ex) \<longrightarrow> isZombie (fst rvb) \<and> ex \<longrightarrow> ((isCNodeCap (fst rvb) \<or> capZombieType (fst rvb) \<noteq> ZombieTCB) \<and> (case gsCNodes s (global.capUntypedPtr (fst rvb)) of None \<Rightarrow> False | Some n \<Rightarrow> (isCNodeCap (fst rvb) \<and> n = capCNodeBits (fst rvb) \<or> n = zombieCTEBits (capZombieType (fst rvb))) \<and> word_of_nat (capZombieNumber (fst rvb)) - 1 < 2 ^ n) \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a))) \<and> (isThreadCap (fst rvb) \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a))) \<and> (capZombieType (fst rvb) = ZombieTCB \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a))))
 2. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (rvb, s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable (fst rvb) sl; ex \<or> \<not> capCyclicZombie (fst rvb) sl\<rbrakk> \<Longrightarrow> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> updateCap sl (fst rvb) \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) sl s\<rbrace>
 3. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a b s''b s cte ptr bits num ctea. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); ((capability.Zombie ptr bits num, b), s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable (capability.Zombie ptr bits num) sl; revoke_progress_ord m (\<lambda>x. map_option capToRPO (cteCaps_of s x)); ctes_of s sl = Some cte; cteCap cte = capability.Zombie ptr bits num; 0 < num; \<not> ex; ctes_of s ptr = Some ctea; \<not> capCyclicZombie (capability.Zombie ptr bits num) sl; isZombie (cteCap ctea) \<longrightarrow> capZombiePtr (cteCap ctea) \<noteq> ptr; fst (case cteCap ctea of capability.NullCap \<Rightarrow> (None, 0) | capability.Zombie p zt n \<Rightarrow> (Some p, 2) | _ \<Rightarrow> (None, 3)) = Some ptr\<rbrakk> \<Longrightarrow> False
 2. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (rvb, s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable (fst rvb) sl; ex \<or> \<not> capCyclicZombie (fst rvb) sl\<rbrakk> \<Longrightarrow> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> updateCap sl (fst rvb) \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) sl s\<rbrace>
 3. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a rvb s''b. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (rvb, s''b) \<in> fst (global.finaliseCap (cteCap rv) rva False s''a); \<not> capRemovable (fst rvb) sl; ex \<or> \<not> capCyclicZombie (fst rvb) sl\<rbrakk> \<Longrightarrow> \<lbrace>?P'33 rv s'' rva s''a rvb\<rbrace> updateCap sl (fst rvb) \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = fst rvb) sl s\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv); (Inr rva, s''a) \<in> fst ((withoutPreemption $ isFinalCapability rv) s'')\<rbrakk> \<Longrightarrow> s''a \<turnstile> \<lbrace>?B16 rv s'' rva\<rbrace> withoutPreemption $ global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> True \<and> True \<and> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (K (fst rvb)) a))) \<and> (\<not> (\<not> ex \<and> capCyclicZombie (fst rvb) sl) \<longrightarrow> ?P'33 rv s'' rva s''a rvb s))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>?B16 rv s''\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P'549 rv s'' rva\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>rvb s. (capRemovable (fst rvb) sl \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. fst rvb) a))) \<and> (ex \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. fst rvb) a)) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl s) \<and> (\<not> capCyclicZombie (fst rvb) sl \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. fst rvb) a)) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl s))\<rbrace>
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. True \<and> ?P'549 rv s'' rva s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P'549 rv s'' rva\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q561 rv s'' rva s''a\<rbrace>
 2. \<And>rv s'' rva s''a rvb s. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); ?Q561 rv s'' rva s''a rvb s\<rbrakk> \<Longrightarrow> (capRemovable (fst rvb) sl \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. fst rvb) a))) \<and> (ex \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. fst rvb) a)) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl s) \<and> (\<not> capCyclicZombie (fst rvb) sl \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. fst rvb) a)) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. True \<and> ?P'549 rv s'' rva s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (6 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P566 rv s'' rva\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>\<lambda>fc s. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>
 2. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P'567 rv s'' rva\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q'564 rv s'' rva s''a\<rbrace>
 3. \<And>rv s'' rva s''a rvb s. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> ?Q'564 rv s'' rva s''a rvb s\<rbrakk> \<Longrightarrow> (capRemovable (fst rvb) sl \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. fst rvb) a))) \<and> (ex \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. fst rvb) a)) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl s) \<and> (\<not> capCyclicZombie (fst rvb) sl \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. fst rvb) a)) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl s))
 4. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. True \<and> ?P566 rv s'' rva s \<and> ?P'567 rv s'' rva s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (5 subgoals):
 1. \<And>rv s'' rva s''a. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s'')\<rbrakk> \<Longrightarrow> \<lbrace>?P'567 rv s'' rva\<rbrace> global.finaliseCap (cteCap rv) rva False \<lbrace>?Q'564 rv s'' rva s''a\<rbrace>
 2. \<And>rv s'' rva s''a rvb s. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> ?Q'564 rv s'' rva s''a rvb s\<rbrakk> \<Longrightarrow> (capRemovable (fst rvb) sl \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. fst rvb) a))) \<and> (ex \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. fst rvb) a)) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl s) \<and> (\<not> capCyclicZombie (fst rvb) sl \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. fst rvb) a)) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl s))
 3. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. True \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> ?P'567 rv s'' rva s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a rvb s. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); (cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (fst rvb = capability.NullCap \<and> (snd rvb \<noteq> capability.NullCap \<longrightarrow> rva \<and> cap_has_cleanup' (cteCap rv) \<and> snd rvb = cteCap rv) \<or> isZombie (fst rvb) \<and> rva \<and> \<not> False \<and> snd rvb = capability.NullCap \<and> global.capUntypedPtr (fst rvb) = global.capUntypedPtr (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)))\<rbrakk> \<Longrightarrow> (capRemovable (fst rvb) sl \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of s a))) \<and> (\<not> capRemovable (fst rvb) sl \<longrightarrow> (\<not> ex \<and> capCyclicZombie (fst rvb) sl \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. fst rvb) a))) \<and> (ex \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. fst rvb) a)) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl s) \<and> (\<not> capCyclicZombie (fst rvb) sl \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (modify_map (cteCaps_of s) sl (\<lambda>a. fst rvb) a)) \<and> cte_wp_at' ((\<lambda>cte. cteCap cte = fst rvb) \<circ> cteCap_update (\<lambda>y. fst rvb)) sl s))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. True \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a a b s cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); revoke_progress_ord m (\<lambda>x. map_option capToRPO (map_option cteCap (ctes_of s x))); a = capability.NullCap \<and> (b \<noteq> capability.NullCap \<longrightarrow> rva \<and> cap_has_cleanup' (cteCap rv) \<and> b = cteCap rv) \<or> isZombie a \<and> rva \<and> b = capability.NullCap \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)); ctes_of s sl = Some cte; cteCap cte = cteCap rv; \<not> capRemovable a sl\<rbrakk> \<Longrightarrow> (\<not> ex \<and> capCyclicZombie a sl \<longrightarrow> revoke_progress_ord m (\<lambda>b. map_option capToRPO (modify_map (\<lambda>x. map_option cteCap (ctes_of s x)) sl (\<lambda>b. a) b))) \<and> (ex \<longrightarrow> revoke_progress_ord m (\<lambda>b. map_option capToRPO (modify_map (\<lambda>x. map_option cteCap (ctes_of s x)) sl (\<lambda>b. a) b))) \<and> (\<not> capCyclicZombie a sl \<longrightarrow> revoke_progress_ord m (\<lambda>b. map_option capToRPO (modify_map (\<lambda>x. map_option cteCap (ctes_of s x)) sl (\<lambda>b. a) b)))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. True \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a a b s cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); revoke_progress_ord m (\<lambda>x. map_option capToRPO (map_option cteCap (ctes_of s x))); a = capability.NullCap \<and> (b \<noteq> capability.NullCap \<longrightarrow> rva \<and> cap_has_cleanup' (cteCap rv) \<and> b = cteCap rv) \<or> isZombie a \<and> rva \<and> b = capability.NullCap \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)); ctes_of s sl = Some cte; cteCap cte = cteCap rv; \<not> capRemovable a sl\<rbrakk> \<Longrightarrow> revoke_progress_ord m (\<lambda>b. map_option capToRPO (modify_map (\<lambda>x. map_option cteCap (ctes_of s x)) sl (\<lambda>b. a) b))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. True \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a a b s cte. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); a = capability.NullCap \<and> (b \<noteq> capability.NullCap \<longrightarrow> rva \<and> cap_has_cleanup' (cteCap rv) \<and> b = cteCap rv) \<or> isZombie a \<and> rva \<and> b = capability.NullCap \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)); ctes_of s sl = Some cte; cteCap cte = cteCap rv; \<not> capRemovable a sl\<rbrakk> \<Longrightarrow> revoke_progress_ord (\<lambda>x. map_option capToRPO (map_option cteCap (ctes_of s x))) (\<lambda>b. map_option capToRPO (modify_map (\<lambda>x. map_option cteCap (ctes_of s x)) sl (\<lambda>b. a) b))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. True \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a a b s cte x. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); a = capability.NullCap \<and> (b \<noteq> capability.NullCap \<longrightarrow> rva \<and> cap_has_cleanup' (cteCap rv) \<and> b = cteCap rv) \<or> isZombie a \<and> rva \<and> b = capability.NullCap \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv)); ctes_of s sl = Some cte; cteCap cte = cteCap rv; \<not> capRemovable a sl; Some x = map_option cteCap (ctes_of s sl)\<rbrakk> \<Longrightarrow> capToRPO a = capToRPO x \<or> rpo_measure sl (Some (capToRPO a)) < rpo_measure sl (Some (capToRPO x))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. True \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (4 subgoals):
 1. \<And>rv s'' rva s''a a b s cte x. \<lbrakk>(rv, s'') \<in> fst (getCTE sl st); cteCap rv \<noteq> capability.NullCap; (rva, s''a) \<in> fst (isFinalCapability rv s''); ctes_of s sl = Some cte; cteCap cte = cteCap rv; \<not> capRemovable a sl; Some x = map_option cteCap (ctes_of s sl); isZombie a \<and> rva \<and> b = capability.NullCap \<and> global.capUntypedPtr a = global.capUntypedPtr (cteCap rv) \<and> (isThreadCap (cteCap rv) \<or> isCNodeCap (cteCap rv) \<or> isZombie (cteCap rv))\<rbrakk> \<Longrightarrow> capToRPO a = capToRPO x \<or> rpo_measure sl (Some (capToRPO a)) < rpo_measure sl (Some (capToRPO x))
 2. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. True \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (3 subgoals):
 1. \<And>rv s''. \<lbrakk>(Inr rv, s'') \<in> fst ((withoutPreemption $ getCTE sl) st); \<not> (isNullCap $ cteCap rv)\<rbrakk> \<Longrightarrow> s'' \<turnstile> \<lbrace>?P'9 rv\<rbrace> withoutPreemption $ isFinalCapability rv \<lbrace>\<lambda>rva s. True \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = cteCap rv) sl s \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. st \<turnstile> \<lbrace>?P'\<rbrace> withoutPreemption $ getCTE sl \<lbrace>\<lambda>rv s. ((isNullCap $ cteCap rv) \<longrightarrow> True \<and> revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)) \<and> (\<not> (isNullCap $ cteCap rv) \<longrightarrow> ?P'9 rv s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> ?P' st proof (prove)
goal (1 subgoal):
 1. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of st) \<Longrightarrow> cte_wp_at' (\<lambda>_. True) sl st \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) sl st \<and> (cteCap cte = capability.NullCap \<longrightarrow> revoke_progress_ord m (\<lambda>a. map_option capToRPO (cteCaps_of st a))) \<and> (cteCap cte \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) sl st)) proof (prove)
goal:
No subgoals! proof (state)
this:
st \<turnstile> \<lbrace>\<lambda>s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace> finaliseSlot' sl ex \<lbrace>\<lambda>rv s. revoke_progress_ord m (map_option capToRPO \<circ> cteCaps_of s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>

goal:
No subgoals!