theory Finalise_DR

lemma dcorres_finalise_cap:
  "cdlcap = transform_cap cap \<Longrightarrow>
      dcorres (\<lambda>r r'. fst r = transform_cap (fst r'))
             \<top> (invs and valid_cap cap and valid_pdpt_objs and cte_wp_at ((=) cap) slot and valid_etcbs)
          (CSpace_D.finalise_cap cdlcap final)
          (CSpace_A.finalise_cap cap final)" apply (case_tac cap) apply (simp_all add: when_def) apply clarsimp apply (rule corres_rel_imp) apply (rule corres_guard_imp[OF dcorres_cancel_all_ipc]) apply (clarsimp simp:invs_def valid_state_def)+ apply (rule corres_rel_imp) apply (rule corres_guard_imp) apply (rule corres_split[OF dcorres_unbind_maybe_notification dcorres_cancel_all_signals]) apply (wp unbind_maybe_notification_valid_etcbs | simp | wpc)+ apply ((clarsimp simp:invs_def valid_state_def)+)[2] apply (simp add:IpcCancel_A.suspend_def bind_assoc) apply clarsimp apply (rule corres_guard_imp) apply (rule corres_split[OF dcorres_unbind_notification]) apply (rule corres_split[OF finalise_cancel_ipc]) apply (rule dcorres_symb_exec_r[OF _ gts_inv gts_inv]) apply (rule dcorres_rhs_noop_above) apply (case_tac "rv = Running"; simp) apply (rule update_restart_pc_dcorres) apply simp apply (rule corres_split) apply (rule set_cap_set_thread_state_inactive) apply (rule dcorres_rhs_noop_above_True[OF tcb_sched_action_dcorres[where P=\<top> and P'=\<top>]]) apply (rule corres_underlying_split[OF prepare_thread_delete_dcorres]) apply (rule iffD2[OF corres_return[where P=\<top> and P'=\<top>]]) apply (clarsimp simp:transform_cap_def) apply wp+ apply (simp add:not_idle_thread_def) apply (case_tac "rv = Running"; simp) apply (wp update_restart_pc_dcorres) apply (wp unbind_notification_invs | simp add: not_idle_thread_def)+ apply clarsimp apply (drule(1) thread_in_thread_cap_not_idle[OF invs_valid_global_refs]) apply (simp add:not_idle_thread_def) apply clarsimp apply (rule corres_guard_imp) apply (rule corres_split[OF dcorres_deleting_irq_handler]) apply (rule iffD2[OF corres_return[where P=\<top> and P'=\<top>]]) apply (clarsimp simp:transform_cap_def) apply (wp|clarsimp)+ apply (clarsimp simp:assert_def corres_free_fail) apply (rename_tac arch_cap) apply (case_tac arch_cap) apply (simp_all add: arch_finalise_cap_def split:arch_cap.split_asm) apply clarsimp
     \<comment> \<open>arch_cap.ASIDPoolCap\<close> apply (rule corres_guard_imp) apply (simp add:transform_asid_def) apply (rule corres_split[OF dcorres_delete_asid_pool]) apply (rule iffD2[OF corres_return[where P=\<top> and P'=\<top>]]) apply (clarsimp simp:transform_cap_def) apply (wp|clarsimp)+ apply (clarsimp split:option.splits | rule conjI)+
     \<comment> \<open>arch_cap.PageCap\<close> apply (simp add:transform_mapping_def) apply (clarsimp simp:transform_mapping_def) apply (rule corres_guard_imp) apply (rule_tac corres_split[OF dcorres_unmap_page]) apply (rule iffD2[OF corres_return[where P=\<top> and P'=\<top>]]) apply (clarsimp simp:transform_cap_def) apply (wp | clarsimp )+ apply simp
   \<comment> \<open>arch_cap.PageTableCap\<close> apply (clarsimp simp:transform_mapping_def split:option.splits) apply (rule dcorres_expand_pfx) apply (rule corres_guard_imp) apply (rule corres_split) apply (rule dcorres_unmap_page_table) apply (rule iffD1[OF le_mask_iff_lt_2n,THEN iffD2],simp add:word_size asid_bits_def) apply (clarsimp simp:valid_cap_def cap_aligned_def)+ apply (simp add:vmsz_aligned_def) apply (rule iffD2[OF corres_return[where P=\<top> and P'=\<top>]]) apply (clarsimp simp:transform_cap_def) apply ((wp|clarsimp )+)[4] apply (rule conjI | clarsimp split:option.splits)+ apply (rule corres_guard_imp) apply (rule corres_split[OF dcorres_delete_asid]) apply (rule iffD2[OF corres_return[where P=\<top> and P'=\<top>]]) apply (clarsimp simp:transform_cap_def) apply (wp|clarsimp split:option.splits)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. cdlcap = transform_cap cap \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) cap) slot and valid_etcbs) (CSpace_D.finalise_cap cdlcap final) (CSpace_A.finalise_cap cap final) proof (prove)
goal (12 subgoals):
 1. \<lbrakk>cdlcap = transform_cap cap; cap = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) cap) slot and valid_etcbs) (CSpace_D.finalise_cap cdlcap final) (CSpace_A.finalise_cap cap final)
 2. \<And>x21 x22 x23 x24. \<lbrakk>cdlcap = transform_cap cap; cap = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) cap) slot and valid_etcbs) (CSpace_D.finalise_cap cdlcap final) (CSpace_A.finalise_cap cap final)
 3. \<And>x31 x32 x33. \<lbrakk>cdlcap = transform_cap cap; cap = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) cap) slot and valid_etcbs) (CSpace_D.finalise_cap cdlcap final) (CSpace_A.finalise_cap cap final)
 4. \<And>x41 x42 x43. \<lbrakk>cdlcap = transform_cap cap; cap = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) cap) slot and valid_etcbs) (CSpace_D.finalise_cap cdlcap final) (CSpace_A.finalise_cap cap final)
 5. \<And>x51 x52 x53. \<lbrakk>cdlcap = transform_cap cap; cap = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) cap) slot and valid_etcbs) (CSpace_D.finalise_cap cdlcap final) (CSpace_A.finalise_cap cap final)
 6. \<And>x61 x62 x63. \<lbrakk>cdlcap = transform_cap cap; cap = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) cap) slot and valid_etcbs) (CSpace_D.finalise_cap cdlcap final) (CSpace_A.finalise_cap cap final)
 7. \<And>x7. \<lbrakk>cdlcap = transform_cap cap; cap = ThreadCap x7\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) cap) slot and valid_etcbs) (CSpace_D.finalise_cap cdlcap final) (CSpace_A.finalise_cap cap final)
 8. \<lbrakk>cdlcap = transform_cap cap; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) cap) slot and valid_etcbs) (CSpace_D.finalise_cap cdlcap final) (CSpace_A.finalise_cap cap final)
 9. \<lbrakk>cdlcap = transform_cap cap; cap = IRQControlCap\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) cap) slot and valid_etcbs) (CSpace_D.finalise_cap cdlcap final) (CSpace_A.finalise_cap cap final)
 10. \<And>x10. \<lbrakk>cdlcap = transform_cap cap; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap cap and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) cap) slot and valid_etcbs) (CSpace_D.finalise_cap cdlcap final) (CSpace_A.finalise_cap cap final)
A total of 12 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>x31 x32 x33. \<lbrakk>cdlcap = cdl_cap.EndpointCap x31 x32 x33; cap = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres ((\<lambda>x. (\<lambda>r'. fst x = transform_cap (fst r')) \<circ> (\<lambda>y. (cap.NullCap, cap.NullCap))) \<circ> (\<lambda>y. (cdl_cap.NullCap, cdl_cap.NullCap))) (\<lambda>_. True) (invs and valid_cap (cap.EndpointCap x31 x32 x33) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (cap.EndpointCap x31 x32 x33)) slot and valid_etcbs) (PageTableUnmap_D.cancel_all_ipc x31) (IpcCancel_A.cancel_all_ipc x31)
 2. \<And>x41 x42 x43. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres ((\<lambda>x. (\<lambda>r'. fst x = transform_cap (fst r')) \<circ> (\<lambda>y. (cap.NullCap, cap.NullCap))) \<circ> (\<lambda>y. (cdl_cap.NullCap, cdl_cap.NullCap))) (\<lambda>_. True) (invs and valid_cap (cap.NotificationCap x41 x42 x43) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot and valid_etcbs) (do y <- PageTableUnmap_D.unbind_maybe_notification x41;
PageTableUnmap_D.cancel_all_ipc x41
od) (do y <- IpcCancel_A.unbind_maybe_notification x41;
cancel_all_signals x41
od)
 3. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ThreadCap x7) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) (do y <- do y <- PageTableUnmap_D.unbind_notification x7;
y <- CSpace_D.cancel_ipc x7;
y <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
CSpace_D.prepare_thread_delete x7
od;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- IpcCancel_A.unbind_notification x7;
y <- IpcCancel_A.suspend x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 4. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 5. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 6. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (6 subgoals):
 1. \<And>x31 x32 x33. \<lbrakk>cdlcap = cdl_cap.EndpointCap x31 x32 x33; cap = cap.EndpointCap x31 x32 x33; final\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>x. (\<lambda>r'. fst x = transform_cap (fst r')) \<circ> (\<lambda>y. (cap.NullCap, cap.NullCap))) \<circ> (\<lambda>y. (cdl_cap.NullCap, cdl_cap.NullCap))) (\<lambda>_. True) (invs and valid_cap (cap.EndpointCap x31 x32 x33) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (cap.EndpointCap x31 x32 x33)) slot and valid_etcbs) (PageTableUnmap_D.cancel_all_ipc x31) (IpcCancel_A.cancel_all_ipc x31)
 2. \<And>x41 x42 x43. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres ((\<lambda>x. (\<lambda>r'. fst x = transform_cap (fst r')) \<circ> (\<lambda>y. (cap.NullCap, cap.NullCap))) \<circ> (\<lambda>y. (cdl_cap.NullCap, cdl_cap.NullCap))) (\<lambda>_. True) (invs and valid_cap (cap.NotificationCap x41 x42 x43) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot and valid_etcbs) (do y <- PageTableUnmap_D.unbind_maybe_notification x41;
PageTableUnmap_D.cancel_all_ipc x41
od) (do y <- IpcCancel_A.unbind_maybe_notification x41;
cancel_all_signals x41
od)
 3. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ThreadCap x7) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) (do y <- do y <- PageTableUnmap_D.unbind_notification x7;
y <- CSpace_D.cancel_ipc x7;
y <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
CSpace_D.prepare_thread_delete x7
od;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- IpcCancel_A.unbind_notification x7;
y <- IpcCancel_A.suspend x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 4. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 5. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 6. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (7 subgoals):
 1. \<And>x31 x32 x33. \<lbrakk>cdlcap = cdl_cap.EndpointCap x31 x32 x33; cap = cap.EndpointCap x31 x32 x33; final\<rbrakk> \<Longrightarrow> dcorres (?r'21 x31 x32 x33) (\<lambda>_. True) (invs and valid_cap (cap.EndpointCap x31 x32 x33) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (cap.EndpointCap x31 x32 x33)) slot and valid_etcbs) (PageTableUnmap_D.cancel_all_ipc x31) (IpcCancel_A.cancel_all_ipc x31)
 2. \<And>x31 x32 x33 x y. \<lbrakk>cdlcap = cdl_cap.EndpointCap x31 x32 x33; cap = cap.EndpointCap x31 x32 x33; final; ?r'21 x31 x32 x33 x y\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. fst x = transform_cap (fst r')) \<circ> (\<lambda>y. (cap.NullCap, cap.NullCap))) \<circ> (\<lambda>y. (cdl_cap.NullCap, cdl_cap.NullCap))) x y
 3. \<And>x41 x42 x43. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres ((\<lambda>x. (\<lambda>r'. fst x = transform_cap (fst r')) \<circ> (\<lambda>y. (cap.NullCap, cap.NullCap))) \<circ> (\<lambda>y. (cdl_cap.NullCap, cdl_cap.NullCap))) (\<lambda>_. True) (invs and valid_cap (cap.NotificationCap x41 x42 x43) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot and valid_etcbs) (do y <- PageTableUnmap_D.unbind_maybe_notification x41;
PageTableUnmap_D.cancel_all_ipc x41
od) (do y <- IpcCancel_A.unbind_maybe_notification x41;
cancel_all_signals x41
od)
 4. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ThreadCap x7) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) (do y <- do y <- PageTableUnmap_D.unbind_notification x7;
y <- CSpace_D.cancel_ipc x7;
y <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
CSpace_D.prepare_thread_delete x7
od;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- IpcCancel_A.unbind_notification x7;
y <- IpcCancel_A.suspend x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 5. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 6. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 7. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (8 subgoals):
 1. \<And>x31 x32 x33 s. \<lbrakk>cdlcap = cdl_cap.EndpointCap x31 x32 x33; cap = cap.EndpointCap x31 x32 x33; final; True\<rbrakk> \<Longrightarrow> True
 2. \<And>x31 x32 x33 s. \<lbrakk>cdlcap = cdl_cap.EndpointCap x31 x32 x33; cap = cap.EndpointCap x31 x32 x33; final; (invs and valid_cap (cap.EndpointCap x31 x32 x33) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (cap.EndpointCap x31 x32 x33)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_state and valid_idle and valid_etcbs) s
 3. \<And>x31 x32 x33 x y. \<lbrakk>cdlcap = cdl_cap.EndpointCap x31 x32 x33; cap = cap.EndpointCap x31 x32 x33; final; dc x y\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. fst x = transform_cap (fst r')) \<circ> (\<lambda>y. (cap.NullCap, cap.NullCap))) \<circ> (\<lambda>y. (cdl_cap.NullCap, cdl_cap.NullCap))) x y
 4. \<And>x41 x42 x43. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres ((\<lambda>x. (\<lambda>r'. fst x = transform_cap (fst r')) \<circ> (\<lambda>y. (cap.NullCap, cap.NullCap))) \<circ> (\<lambda>y. (cdl_cap.NullCap, cdl_cap.NullCap))) (\<lambda>_. True) (invs and valid_cap (cap.NotificationCap x41 x42 x43) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot and valid_etcbs) (do y <- PageTableUnmap_D.unbind_maybe_notification x41;
PageTableUnmap_D.cancel_all_ipc x41
od) (do y <- IpcCancel_A.unbind_maybe_notification x41;
cancel_all_signals x41
od)
 5. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ThreadCap x7) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) (do y <- do y <- PageTableUnmap_D.unbind_notification x7;
y <- CSpace_D.cancel_ipc x7;
y <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
CSpace_D.prepare_thread_delete x7
od;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- IpcCancel_A.unbind_notification x7;
y <- IpcCancel_A.suspend x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 6. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 7. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 8. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (5 subgoals):
 1. \<And>x41 x42 x43. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43; final\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>x. (\<lambda>r'. fst x = transform_cap (fst r')) \<circ> (\<lambda>y. (cap.NullCap, cap.NullCap))) \<circ> (\<lambda>y. (cdl_cap.NullCap, cdl_cap.NullCap))) (\<lambda>_. True) (valid_pspace and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and valid_cap (cap.NotificationCap x41 x42 x43) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot and valid_etcbs) (do y <- PageTableUnmap_D.unbind_maybe_notification x41;
PageTableUnmap_D.cancel_all_ipc x41
od) (do y <- IpcCancel_A.unbind_maybe_notification x41;
cancel_all_signals x41
od)
 2. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ThreadCap x7) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) (do y <- do y <- PageTableUnmap_D.unbind_notification x7;
y <- CSpace_D.cancel_ipc x7;
y <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
CSpace_D.prepare_thread_delete x7
od;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- IpcCancel_A.unbind_notification x7;
y <- IpcCancel_A.suspend x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 3. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 4. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 5. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (6 subgoals):
 1. \<And>x41 x42 x43. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43; final\<rbrakk> \<Longrightarrow> dcorres (?r'33 x41 x42 x43) (\<lambda>_. True) (valid_pspace and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and valid_cap (cap.NotificationCap x41 x42 x43) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot and valid_etcbs) (do y <- PageTableUnmap_D.unbind_maybe_notification x41;
PageTableUnmap_D.cancel_all_ipc x41
od) (do y <- IpcCancel_A.unbind_maybe_notification x41;
cancel_all_signals x41
od)
 2. \<And>x41 x42 x43 x y. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43; final; ?r'33 x41 x42 x43 x y\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. fst x = transform_cap (fst r')) \<circ> (\<lambda>y. (cap.NullCap, cap.NullCap))) \<circ> (\<lambda>y. (cdl_cap.NullCap, cdl_cap.NullCap))) x y
 3. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ThreadCap x7) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) (do y <- do y <- PageTableUnmap_D.unbind_notification x7;
y <- CSpace_D.cancel_ipc x7;
y <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
CSpace_D.prepare_thread_delete x7
od;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- IpcCancel_A.unbind_notification x7;
y <- IpcCancel_A.suspend x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 4. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 5. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 6. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (8 subgoals):
 1. \<And>x41 x42 x43. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43; final\<rbrakk> \<Longrightarrow> dcorres (?r'33 x41 x42 x43) (?Q36 x41 x42 x43) (?Q'36 x41 x42 x43) (do y <- PageTableUnmap_D.unbind_maybe_notification x41;
PageTableUnmap_D.cancel_all_ipc x41
od) (do y <- IpcCancel_A.unbind_maybe_notification x41;
cancel_all_signals x41
od)
 2. \<And>x41 x42 x43 s. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43; final; True\<rbrakk> \<Longrightarrow> ?Q36 x41 x42 x43 s
 3. \<And>x41 x42 x43 s. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43; final; (valid_pspace and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and valid_cap (cap.NotificationCap x41 x42 x43) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'36 x41 x42 x43 s
 4. \<And>x41 x42 x43 x y. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43; final; ?r'33 x41 x42 x43 x y\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. fst x = transform_cap (fst r')) \<circ> (\<lambda>y. (cap.NullCap, cap.NullCap))) \<circ> (\<lambda>y. (cdl_cap.NullCap, cdl_cap.NullCap))) x y
 5. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ThreadCap x7) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) (do y <- do y <- PageTableUnmap_D.unbind_notification x7;
y <- CSpace_D.cancel_ipc x7;
y <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
CSpace_D.prepare_thread_delete x7
od;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- IpcCancel_A.unbind_notification x7;
y <- IpcCancel_A.suspend x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 6. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 7. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 8. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (9 subgoals):
 1. \<And>x41 x42 x43. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q40 x41 x42 x43\<rbrace> PageTableUnmap_D.unbind_maybe_notification x41 \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>x41 x42 x43. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 x41 x42 x43\<rbrace> IpcCancel_A.unbind_maybe_notification x41 \<lbrace>\<lambda>y. valid_state and valid_idle and valid_etcbs\<rbrace>
 3. \<And>x41 x42 x43 s. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q40 x41 x42 x43) s
 4. \<And>x41 x42 x43 s. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43; final; (valid_pspace and valid_mdb and valid_ioc and valid_idle and only_idle and if_unsafe_then_cap and valid_reply_caps and valid_reply_masters and valid_global_refs and valid_arch_state and valid_irq_node and valid_irq_handlers and valid_irq_states and valid_machine_state and valid_vspace_objs and valid_arch_caps and valid_global_objs and valid_kernel_mappings and equal_kernel_mappings and valid_asid_map and valid_global_vspace_mappings and pspace_in_kernel_window and cap_refs_in_kernel_window and pspace_respects_device_region and cap_refs_respects_device_region and cur_tcb and valid_cap (cap.NotificationCap x41 x42 x43) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_etcbs and valid_idle and valid_state and ?Q'40 x41 x42 x43) s
 5. \<And>x41 x42 x43 x y. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43; final; dc x y\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. fst x = transform_cap (fst r')) \<circ> (\<lambda>y. (cap.NullCap, cap.NullCap))) \<circ> (\<lambda>y. (cdl_cap.NullCap, cdl_cap.NullCap))) x y
 6. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ThreadCap x7) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) (do y <- do y <- PageTableUnmap_D.unbind_notification x7;
y <- CSpace_D.cancel_ipc x7;
y <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
CSpace_D.prepare_thread_delete x7
od;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- IpcCancel_A.unbind_notification x7;
y <- IpcCancel_A.suspend x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 7. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 8. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 9. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (6 subgoals):
 1. \<And>x41 x42 x43 s. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43; final; valid_pspace s \<and> valid_mdb s \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> s \<turnstile> cap.NotificationCap x41 x42 x43 \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot s \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> valid_state s
 2. \<And>x41 x42 x43 x y. \<lbrakk>cdlcap = cdl_cap.NotificationCap x41 x42 x43; cap = cap.NotificationCap x41 x42 x43; final; dc x y\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>r'. fst x = transform_cap (fst r')) \<circ> (\<lambda>y. (cap.NullCap, cap.NullCap))) \<circ> (\<lambda>y. (cdl_cap.NullCap, cdl_cap.NullCap))) x y
 3. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ThreadCap x7) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) (do y <- do y <- PageTableUnmap_D.unbind_notification x7;
y <- CSpace_D.cancel_ipc x7;
y <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
CSpace_D.prepare_thread_delete x7
od;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- IpcCancel_A.unbind_notification x7;
y <- IpcCancel_A.suspend x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 4. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 5. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 6. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (4 subgoals):
 1. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ThreadCap x7) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) (do y <- do y <- PageTableUnmap_D.unbind_notification x7;
y <- CSpace_D.cancel_ipc x7;
y <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
CSpace_D.prepare_thread_delete x7
od;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- IpcCancel_A.unbind_notification x7;
y <- IpcCancel_A.suspend x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 2. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 3. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 4. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (4 subgoals):
 1. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ThreadCap x7) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) (do x <- PageTableUnmap_D.unbind_notification x7;
x <- CSpace_D.cancel_ipc x7;
x <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
y <- CSpace_D.prepare_thread_delete x7;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- IpcCancel_A.unbind_notification x7;
x <- IpcCancel_A.cancel_ipc x7;
x <- get_thread_state x7;
x <- if x = Running then update_restart_pc x7 else return ();
x <- set_thread_state x7 Inactive;
y <- tcb_sched_action tcb_sched_dequeue x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 2. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 3. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 4. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (4 subgoals):
 1. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ThreadCap x7) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) (do x <- PageTableUnmap_D.unbind_notification x7;
x <- CSpace_D.cancel_ipc x7;
x <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
y <- CSpace_D.prepare_thread_delete x7;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- IpcCancel_A.unbind_notification x7;
x <- IpcCancel_A.cancel_ipc x7;
x <- get_thread_state x7;
x <- if x = Running then update_restart_pc x7 else return ();
x <- set_thread_state x7 Inactive;
y <- tcb_sched_action tcb_sched_dequeue x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 2. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 3. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 4. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (6 subgoals):
 1. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?Q64 x7) (?Q'64 x7) (do x <- PageTableUnmap_D.unbind_notification x7;
x <- CSpace_D.cancel_ipc x7;
x <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
y <- CSpace_D.prepare_thread_delete x7;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- IpcCancel_A.unbind_notification x7;
x <- IpcCancel_A.cancel_ipc x7;
x <- get_thread_state x7;
x <- if x = Running then update_restart_pc x7 else return ();
x <- set_thread_state x7 Inactive;
y <- tcb_sched_action tcb_sched_dequeue x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 2. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; True\<rbrakk> \<Longrightarrow> ?Q64 x7 s
 3. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; (invs and valid_cap (ThreadCap x7) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'64 x7 s
 4. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 5. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 6. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (8 subgoals):
 1. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?R68 x7 x) (?R'68 x7 y) (do x <- CSpace_D.cancel_ipc x7;
x <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
y <- CSpace_D.prepare_thread_delete x7;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do x <- IpcCancel_A.cancel_ipc x7;
x <- get_thread_state x7;
x <- if x = Running then update_restart_pc x7 else return ();
x <- set_thread_state x7 Inactive;
y <- tcb_sched_action tcb_sched_dequeue x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 2. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>?R68 x7\<rbrace>
 3. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 x7\<rbrace> IpcCancel_A.unbind_notification x7 \<lbrace>?R'68 x7\<rbrace>
 4. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q68 x7) s
 5. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; (invs and valid_cap (ThreadCap x7) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_etcbs and not_idle_thread x7 and ?Q'68 x7) s
 6. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 7. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 8. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (10 subgoals):
 1. \<And>x7 x y xa xb. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?R73 x7 x y xa) (?R'73 x7 x y xb) (do x <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
y <- CSpace_D.prepare_thread_delete x7;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do x <- get_thread_state x7;
x <- if x = Running then update_restart_pc x7 else return ();
x <- set_thread_state x7 Inactive;
y <- tcb_sched_action tcb_sched_dequeue x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 2. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>?R73 x7 x y\<rbrace>
 3. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>?R'73 x7 x y\<rbrace>
 4. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
 5. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 x7\<rbrace> IpcCancel_A.unbind_notification x7 \<lbrace>\<lambda>y. not_idle_thread x7 and invs and valid_etcbs and ?Q'77 x7 y\<rbrace>
 6. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q68 x7) s
 7. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; (invs and valid_cap (ThreadCap x7) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_etcbs and not_idle_thread x7 and ?Q'68 x7) s
 8. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 9. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 10. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (10 subgoals):
 1. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?R73 x7 x y xa) (?R'73 x7 x y xb) (do x <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
y <- CSpace_D.prepare_thread_delete x7;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do x <- if rv = Running then update_restart_pc x7 else return ();
x <- set_thread_state x7 Inactive;
y <- tcb_sched_action tcb_sched_dequeue x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 2. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>?R73 x7 x y\<rbrace>
 3. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>?R'73 x7 x y\<rbrace>
 4. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
 5. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 x7\<rbrace> IpcCancel_A.unbind_notification x7 \<lbrace>\<lambda>y. not_idle_thread x7 and invs and valid_etcbs and ?Q'77 x7 y\<rbrace>
 6. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q68 x7) s
 7. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; (invs and valid_cap (ThreadCap x7) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_etcbs and not_idle_thread x7 and ?Q'68 x7) s
 8. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 9. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 10. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (13 subgoals):
 1. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> dcorres (?anyrel87 x7 x y xa xb rv) (?R73 x7 x y xa) (?R'73 x7 x y xb) (return ()) (if rv = Running then update_restart_pc x7 else return ())
 2. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?Q87 x7 x y xa xb rv) (?Q'87 x7 x y xa xb rv) (do x <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
y <- CSpace_D.prepare_thread_delete x7;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do x <- set_thread_state x7 Inactive;
y <- tcb_sched_action tcb_sched_dequeue x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 3. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R73 x7 x y xa\<rbrace> return () \<lbrace>\<lambda>xc. ?Q87 x7 x y xa xb rv\<rbrace>
 4. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'73 x7 x y xb\<rbrace> if rv = Running then update_restart_pc x7 else return () \<lbrace>\<lambda>xc. ?Q'87 x7 x y xa xb rv\<rbrace>
 5. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>?R73 x7 x y\<rbrace>
 6. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>?R'73 x7 x y\<rbrace>
 7. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
 8. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 x7\<rbrace> IpcCancel_A.unbind_notification x7 \<lbrace>\<lambda>y. not_idle_thread x7 and invs and valid_etcbs and ?Q'77 x7 y\<rbrace>
 9. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q68 x7) s
 10. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; (invs and valid_cap (ThreadCap x7) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_etcbs and not_idle_thread x7 and ?Q'68 x7) s
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x7 rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; rv = Running\<rbrakk> \<Longrightarrow> dcorres (?anyrel87 x7 () () () () Running) (?R73 x7 () () ()) (?R'73 x7 () () ()) (return ()) (update_restart_pc x7)
 2. \<And>x7 rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; rv \<noteq> Running\<rbrakk> \<Longrightarrow> (\<exists>s. ?R73 x7 () () () s \<and> (\<exists>s'. ?R'73 x7 () () () s' \<and> transform s' = s)) \<longrightarrow> ?anyrel87 x7 () () () () rv () ()
 3. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?Q87 x7 x y xa xb rv) (?Q'87 x7 x y xa xb rv) (do x <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
y <- CSpace_D.prepare_thread_delete x7;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do x <- set_thread_state x7 Inactive;
y <- tcb_sched_action tcb_sched_dequeue x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 4. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R73 x7 x y xa\<rbrace> return () \<lbrace>\<lambda>xc. ?Q87 x7 x y xa xb rv\<rbrace>
 5. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'73 x7 x y xb\<rbrace> if rv = Running then update_restart_pc x7 else return () \<lbrace>\<lambda>xc. ?Q'87 x7 x y xa xb rv\<rbrace>
 6. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>?R73 x7 x y\<rbrace>
 7. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>?R'73 x7 x y\<rbrace>
 8. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
 9. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 x7\<rbrace> IpcCancel_A.unbind_notification x7 \<lbrace>\<lambda>y. not_idle_thread x7 and invs and valid_etcbs and ?Q'77 x7 y\<rbrace>
 10. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q68 x7) s
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x7 rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; rv \<noteq> Running\<rbrakk> \<Longrightarrow> (\<exists>s. ?R73 x7 () () () s \<and> (\<exists>s'. ?R'73 x7 () () () s' \<and> transform s' = s)) \<longrightarrow> dc () ()
 2. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?Q87 x7 x y xa xb rv) (?Q'87 x7 x y xa xb rv) (do x <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
y <- CSpace_D.prepare_thread_delete x7;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do x <- set_thread_state x7 Inactive;
y <- tcb_sched_action tcb_sched_dequeue x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 3. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R73 x7 x y xa\<rbrace> return () \<lbrace>\<lambda>xc. ?Q87 x7 x y xa xb rv\<rbrace>
 4. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'73 x7 x y xb\<rbrace> if rv = Running then update_restart_pc x7 else return () \<lbrace>\<lambda>xc. ?Q'87 x7 x y xa xb rv\<rbrace>
 5. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>?R73 x7 x y\<rbrace>
 6. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>?R'73 x7 x y\<rbrace>
 7. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
 8. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 x7\<rbrace> IpcCancel_A.unbind_notification x7 \<lbrace>\<lambda>y. not_idle_thread x7 and invs and valid_etcbs and ?Q'77 x7 y\<rbrace>
 9. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q68 x7) s
 10. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; (invs and valid_cap (ThreadCap x7) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_etcbs and not_idle_thread x7 and ?Q'68 x7) s
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?Q87 x7 x y xa xb rv) (?Q'87 x7 x y xa xb rv) (do x <- KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap;
y <- CSpace_D.prepare_thread_delete x7;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do x <- set_thread_state x7 Inactive;
y <- tcb_sched_action tcb_sched_dequeue x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 2. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R73 x7 x y xa\<rbrace> return () \<lbrace>\<lambda>xc. ?Q87 x7 x y xa xb rv\<rbrace>
 3. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'73 x7 x y xb\<rbrace> if rv = Running then update_restart_pc x7 else return () \<lbrace>\<lambda>xc. ?Q'87 x7 x y xa xb rv\<rbrace>
 4. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>?R73 x7 x y\<rbrace>
 5. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>?R'73 x7 x y\<rbrace>
 6. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
 7. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 x7\<rbrace> IpcCancel_A.unbind_notification x7 \<lbrace>\<lambda>y. not_idle_thread x7 and invs and valid_etcbs and ?Q'77 x7 y\<rbrace>
 8. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q68 x7) s
 9. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; (invs and valid_cap (ThreadCap x7) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_etcbs and not_idle_thread x7 and ?Q'68 x7) s
 10. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> dcorres (?r'102 x7 x y xa xb rv) (?P102 x7 x y xa xb rv) (?P'102 x7 x y xa xb rv) (KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap) (set_thread_state x7 Inactive)
 2. \<And>x7 x y xa xb rv xc xd. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb; ?r'102 x7 x y xa xb rv xc xd\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?R102 x7 x y xa xb rv xc) (?R'102 x7 x y xa xb rv xd) (do y <- CSpace_D.prepare_thread_delete x7;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- tcb_sched_action tcb_sched_dequeue x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 3. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q102 x7 x y xa xb rv\<rbrace> KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap \<lbrace>?R102 x7 x y xa xb rv\<rbrace>
 4. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'102 x7 x y xa xb rv\<rbrace> set_thread_state x7 Inactive \<lbrace>?R'102 x7 x y xa xb rv\<rbrace>
 5. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R73 x7 x y xa\<rbrace> return () \<lbrace>\<lambda>xc. ?P102 x7 x y xa xb rv and ?Q102 x7 x y xa xb rv\<rbrace>
 6. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'73 x7 x y xb\<rbrace> if rv = Running then update_restart_pc x7 else return () \<lbrace>\<lambda>xc. ?P'102 x7 x y xa xb rv and ?Q'102 x7 x y xa xb rv\<rbrace>
 7. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>?R73 x7 x y\<rbrace>
 8. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>?R'73 x7 x y\<rbrace>
 9. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
 10. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 x7\<rbrace> IpcCancel_A.unbind_notification x7 \<lbrace>\<lambda>y. not_idle_thread x7 and invs and valid_etcbs and ?Q'77 x7 y\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x7 x y xa xb rv xc xd. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb; dc xc xd\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?R102 x7 x y xa xb rv xc) (?R'102 x7 x y xa xb rv xd) (do y <- CSpace_D.prepare_thread_delete x7;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- tcb_sched_action tcb_sched_dequeue x7;
y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 2. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q102 x7 x y xa xb rv\<rbrace> KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap \<lbrace>?R102 x7 x y xa xb rv\<rbrace>
 3. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'102 x7 x y xa xb rv\<rbrace> set_thread_state x7 Inactive \<lbrace>?R'102 x7 x y xa xb rv\<rbrace>
 4. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R73 x7 x y xa\<rbrace> return () \<lbrace>\<lambda>xc. (\<lambda>_. True) and ?Q102 x7 x y xa xb rv\<rbrace>
 5. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'73 x7 x y xb\<rbrace> if rv = Running then update_restart_pc x7 else return () \<lbrace>\<lambda>xc. not_idle_thread x7 and valid_etcbs and ?Q'102 x7 x y xa xb rv\<rbrace>
 6. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>?R73 x7 x y\<rbrace>
 7. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>?R'73 x7 x y\<rbrace>
 8. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
 9. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 x7\<rbrace> IpcCancel_A.unbind_notification x7 \<lbrace>\<lambda>y. not_idle_thread x7 and invs and valid_etcbs and ?Q'77 x7 y\<rbrace>
 10. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q68 x7) s
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x7 x y xa xb rv xc xd. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb; dc xc xd\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>y. True) (\<lambda>y. True) (do y <- CSpace_D.prepare_thread_delete x7;
return (ZombieCap x7, cdl_cap.NullCap)
od) (do y <- local.prepare_thread_delete x7;
return (Zombie x7 None 5, cap.NullCap)
od)
 2. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q102 x7 x y xa xb rv\<rbrace> KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap \<lbrace>\<lambda>xc _. True\<rbrace>
 3. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'102 x7 x y xa xb rv\<rbrace> set_thread_state x7 Inactive \<lbrace>\<lambda>xd _. True\<rbrace>
 4. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R73 x7 x y xa\<rbrace> return () \<lbrace>\<lambda>xc. (\<lambda>_. True) and ?Q102 x7 x y xa xb rv\<rbrace>
 5. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'73 x7 x y xb\<rbrace> if rv = Running then update_restart_pc x7 else return () \<lbrace>\<lambda>xc. not_idle_thread x7 and valid_etcbs and ?Q'102 x7 x y xa xb rv\<rbrace>
 6. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>?R73 x7 x y\<rbrace>
 7. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>?R'73 x7 x y\<rbrace>
 8. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
 9. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 x7\<rbrace> IpcCancel_A.unbind_notification x7 \<lbrace>\<lambda>y. not_idle_thread x7 and invs and valid_etcbs and ?Q'77 x7 y\<rbrace>
 10. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q68 x7) s
A total of 14 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x7 x y xa xb rv xc xd ya yb. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb; dc xc xd; dc ya yb\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?Q111 x7 x y xa xb rv xc xd ya) (?Q'111 x7 x y xa xb rv xc xd yb) (return (ZombieCap x7, cdl_cap.NullCap)) (return (Zombie x7 None 5, cap.NullCap))
 2. \<And>x7 x y xa xb rv xc xd. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb; dc xc xd\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>y. True\<rbrace> CSpace_D.prepare_thread_delete x7 \<lbrace>?Q111 x7 x y xa xb rv xc xd\<rbrace>
 3. \<And>x7 x y xa xb rv xc xd. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb; dc xc xd\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>y. True\<rbrace> local.prepare_thread_delete x7 \<lbrace>?Q'111 x7 x y xa xb rv xc xd\<rbrace>
 4. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q102 x7 x y xa xb rv\<rbrace> KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap \<lbrace>\<lambda>xc _. True\<rbrace>
 5. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'102 x7 x y xa xb rv\<rbrace> set_thread_state x7 Inactive \<lbrace>\<lambda>xd _. True\<rbrace>
 6. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R73 x7 x y xa\<rbrace> return () \<lbrace>\<lambda>xc. (\<lambda>_. True) and ?Q102 x7 x y xa xb rv\<rbrace>
 7. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'73 x7 x y xb\<rbrace> if rv = Running then update_restart_pc x7 else return () \<lbrace>\<lambda>xc. not_idle_thread x7 and valid_etcbs and ?Q'102 x7 x y xa xb rv\<rbrace>
 8. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>?R73 x7 x y\<rbrace>
 9. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>?R'73 x7 x y\<rbrace>
 10. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x7 x y xa xb rv xc xd ya yb. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb; dc xc xd; dc ya yb\<rbrakk> \<Longrightarrow> (\<exists>s s'. True \<and> True \<and> (s, s') \<in> {ss'. transform (snd ss') = fst ss'}) \<longrightarrow> fst (ZombieCap x7, cdl_cap.NullCap) = transform_cap (fst (Zombie x7 None 5, cap.NullCap))
 2. \<And>x7 x y xa xb rv xc xd. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb; dc xc xd\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>y. True\<rbrace> CSpace_D.prepare_thread_delete x7 \<lbrace>\<lambda>ya _. True\<rbrace>
 3. \<And>x7 x y xa xb rv xc xd. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb; dc xc xd\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>y. True\<rbrace> local.prepare_thread_delete x7 \<lbrace>\<lambda>yb _. True\<rbrace>
 4. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q102 x7 x y xa xb rv\<rbrace> KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap \<lbrace>\<lambda>xc _. True\<rbrace>
 5. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'102 x7 x y xa xb rv\<rbrace> set_thread_state x7 Inactive \<lbrace>\<lambda>xd _. True\<rbrace>
 6. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R73 x7 x y xa\<rbrace> return () \<lbrace>\<lambda>xc. (\<lambda>_. True) and ?Q102 x7 x y xa xb rv\<rbrace>
 7. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'73 x7 x y xb\<rbrace> if rv = Running then update_restart_pc x7 else return () \<lbrace>\<lambda>xc. not_idle_thread x7 and valid_etcbs and ?Q'102 x7 x y xa xb rv\<rbrace>
 8. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>?R73 x7 x y\<rbrace>
 9. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>?R'73 x7 x y\<rbrace>
 10. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x7 x y xa xb rv xc xd. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb; dc xc xd\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>y. True\<rbrace> CSpace_D.prepare_thread_delete x7 \<lbrace>\<lambda>ya _. True\<rbrace>
 2. \<And>x7 x y xa xb rv xc xd. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb; dc xc xd\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>y. True\<rbrace> local.prepare_thread_delete x7 \<lbrace>\<lambda>yb _. True\<rbrace>
 3. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q102 x7 x y xa xb rv\<rbrace> KHeap_D.set_cap (x7, tcb_pending_op_slot) cdl_cap.NullCap \<lbrace>\<lambda>xc _. True\<rbrace>
 4. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'102 x7 x y xa xb rv\<rbrace> set_thread_state x7 Inactive \<lbrace>\<lambda>xd _. True\<rbrace>
 5. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R73 x7 x y xa\<rbrace> return () \<lbrace>\<lambda>xc. (\<lambda>_. True) and ?Q102 x7 x y xa xb rv\<rbrace>
 6. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'73 x7 x y xb\<rbrace> if rv = Running then update_restart_pc x7 else return () \<lbrace>\<lambda>xc. not_idle_thread x7 and valid_etcbs and ?Q'102 x7 x y xa xb rv\<rbrace>
 7. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>?R73 x7 x y\<rbrace>
 8. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>?R'73 x7 x y\<rbrace>
 9. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
 10. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 x7\<rbrace> IpcCancel_A.unbind_notification x7 \<lbrace>\<lambda>y. not_idle_thread x7 and invs and valid_etcbs and ?Q'77 x7 y\<rbrace>
A total of 15 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x7 x y xa xb rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y; dc xa xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'73 x7 x y xb\<rbrace> if rv = Running then update_restart_pc x7 else return () \<lbrace>\<lambda>x s. not_idle_thread x7 s \<and> valid_etcbs s \<and> True\<rbrace>
 2. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 3. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>?R'73 x7 x y\<rbrace>
 4. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
 5. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 x7\<rbrace> IpcCancel_A.unbind_notification x7 \<lbrace>\<lambda>y. not_idle_thread x7 and invs and valid_etcbs and ?Q'77 x7 y\<rbrace>
 6. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q68 x7) s
 7. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; (invs and valid_cap (ThreadCap x7) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_etcbs and not_idle_thread x7 and ?Q'68 x7) s
 8. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 9. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 10. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (10 subgoals):
 1. \<And>x7 rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> (rv = Running \<longrightarrow> \<lbrace>?R'73 x7 () () ()\<rbrace> update_restart_pc x7 \<lbrace>\<lambda>x s. x7 \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>) \<and> (rv \<noteq> Running \<longrightarrow> \<lbrace>?R'73 x7 () () ()\<rbrace> return () \<lbrace>\<lambda>x s. x7 \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>)
 2. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 3. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>?R'73 x7 x y\<rbrace>
 4. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
 5. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 x7\<rbrace> IpcCancel_A.unbind_notification x7 \<lbrace>\<lambda>y. not_idle_thread x7 and invs and valid_etcbs and ?Q'77 x7 y\<rbrace>
 6. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q68 x7) s
 7. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; (invs and valid_cap (ThreadCap x7) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_etcbs and not_idle_thread x7 and ?Q'68 x7) s
 8. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 9. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 10. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (11 subgoals):
 1. \<And>x7 rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; rv = Running\<rbrakk> \<Longrightarrow> \<lbrace>?R'73 x7 () () ()\<rbrace> update_restart_pc x7 \<lbrace>\<lambda>x s. x7 \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 2. \<And>x7 rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; rv \<noteq> Running\<rbrakk> \<Longrightarrow> \<lbrace>?R'73 x7 () () ()\<rbrace> return () \<lbrace>\<lambda>x s. x7 \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 3. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 4. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>?R'73 x7 x y\<rbrace>
 5. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
 6. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 x7\<rbrace> IpcCancel_A.unbind_notification x7 \<lbrace>\<lambda>y. not_idle_thread x7 and invs and valid_etcbs and ?Q'77 x7 y\<rbrace>
 7. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q68 x7) s
 8. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; (invs and valid_cap (ThreadCap x7) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_etcbs and not_idle_thread x7 and ?Q'68 x7) s
 9. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 10. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x7 rv. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; rv \<noteq> Running\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. x7 \<noteq> idle_thread a \<and> valid_etcbs a\<rbrace> return () \<lbrace>\<lambda>x s. x7 \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 2. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q75 x7 x\<rbrace> CSpace_D.cancel_ipc x7 \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 3. \<And>x7 x y. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; dc x y\<rbrakk> \<Longrightarrow> \<lbrace>?Q'77 x7 y\<rbrace> IpcCancel_A.cancel_ipc x7 \<lbrace>\<lambda>a b. x7 \<noteq> idle_thread b \<and> valid_etcbs b\<rbrace>
 4. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 x7\<rbrace> PageTableUnmap_D.unbind_notification x7 \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q75 x7 x\<rbrace>
 5. \<And>x7. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 x7\<rbrace> IpcCancel_A.unbind_notification x7 \<lbrace>\<lambda>y. not_idle_thread x7 and invs and valid_etcbs and ?Q'77 x7 y\<rbrace>
 6. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q68 x7) s
 7. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; (invs and valid_cap (ThreadCap x7) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ThreadCap x7)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_etcbs and not_idle_thread x7 and ?Q'68 x7) s
 8. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 9. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 10. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (4 subgoals):
 1. \<And>x7 s. \<lbrakk>cdlcap = TcbCap x7; cap = ThreadCap x7; final; invs s \<and> s \<turnstile> ThreadCap x7 \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> cte_wp_at ((=) (ThreadCap x7)) slot s \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> x7 \<noteq> idle_thread s
 2. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 3. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 4. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>cdlcap = TcbCap (idle_thread s); cap = ThreadCap (idle_thread s); final; invs s; s \<turnstile> ThreadCap (idle_thread s); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cte_wp_at ((=) (ThreadCap (idle_thread s))) slot s; valid_etcbs s\<rbrakk> \<Longrightarrow> False
 2. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 3. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 4. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>cdlcap = TcbCap (idle_thread s); cap = ThreadCap (idle_thread s); final; s \<turnstile> ThreadCap (idle_thread s); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cte_wp_at ((=) (ThreadCap (idle_thread s))) slot s; valid_etcbs s; not_idle_thread (idle_thread s) s\<rbrakk> \<Longrightarrow> False
 2. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 3. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 4. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (3 subgoals):
 1. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 2. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 3. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (3 subgoals):
 1. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 2. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 3. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (5 subgoals):
 1. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?Q217 x10) (?Q'217 x10) (do y <- CSpace_D.deleting_irq_handler x10;
return (cdl_cap.NullCap, IrqHandlerCap x10)
od) (do y <- CSpace_A.deleting_irq_handler x10;
return (cap.NullCap, IRQHandlerCap x10)
od)
 2. \<And>x10 s. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final; True\<rbrakk> \<Longrightarrow> ?Q217 x10 s
 3. \<And>x10 s. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final; (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'217 x10 s
 4. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 5. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (7 subgoals):
 1. \<And>x10 y ya. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final; dc y ya\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?R221 x10 y) (?R'221 x10 ya) (return (cdl_cap.NullCap, IrqHandlerCap x10)) (return (cap.NullCap, IRQHandlerCap x10))
 2. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q221 x10\<rbrace> CSpace_D.deleting_irq_handler x10 \<lbrace>?R221 x10\<rbrace>
 3. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'221 x10\<rbrace> CSpace_A.deleting_irq_handler x10 \<lbrace>?R'221 x10\<rbrace>
 4. \<And>x10 s. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q221 x10) s
 5. \<And>x10 s. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final; (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and ?Q'221 x10) s
 6. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 7. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (7 subgoals):
 1. \<And>x10 y ya. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final; dc y ya\<rbrakk> \<Longrightarrow> (\<exists>s s'. True \<and> True \<and> (s, s') \<in> {ss'. transform (snd ss') = fst ss'}) \<longrightarrow> fst (cdl_cap.NullCap, IrqHandlerCap x10) = transform_cap (fst (cap.NullCap, IRQHandlerCap x10))
 2. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q221 x10\<rbrace> CSpace_D.deleting_irq_handler x10 \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'221 x10\<rbrace> CSpace_A.deleting_irq_handler x10 \<lbrace>\<lambda>ya _. True\<rbrace>
 4. \<And>x10 s. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q221 x10) s
 5. \<And>x10 s. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final; (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and ?Q'221 x10) s
 6. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 7. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (6 subgoals):
 1. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q221 x10\<rbrace> CSpace_D.deleting_irq_handler x10 \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>x10. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'221 x10\<rbrace> CSpace_A.deleting_irq_handler x10 \<lbrace>\<lambda>ya _. True\<rbrace>
 3. \<And>x10 s. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q221 x10) s
 4. \<And>x10 s. \<lbrakk>cdlcap = IrqHandlerCap x10; cap = IRQHandlerCap x10; final; (invs and valid_cap (IRQHandlerCap x10) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (IRQHandlerCap x10)) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and ?Q'221 x10) s
 5. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 6. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (2 subgoals):
 1. \<And>x111 x112 x113. \<lbrakk>cdlcap = ZombieCap x111; cap = Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (Zombie x111 x112 x113) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (Zombie x111 x112 x113)) slot and valid_etcbs) (do y <- assert final;
return (ZombieCap x111, cdl_cap.NullCap)
od) (do y <- assert final;
return (Zombie x111 x112 x113, cap.NullCap)
od)
 2. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (1 subgoal):
 1. \<And>x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap x12); cap = ArchObjectCap x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap x12) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap x12)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap x12)) final) (arch_finalise_cap x12 final) proof (prove)
goal (1 subgoal):
 1. \<And>arch_cap. \<lbrakk>cdlcap = transform_cap (ArchObjectCap arch_cap); cap = ArchObjectCap arch_cap\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap arch_cap) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap arch_cap)) final) (arch_finalise_cap arch_cap final) proof (prove)
goal (5 subgoals):
 1. \<And>arch_cap x11 x12. \<lbrakk>cdlcap = transform_cap (ArchObjectCap arch_cap); cap = ArchObjectCap arch_cap; arch_cap = ASIDPoolCap x11 x12\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap arch_cap) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap arch_cap)) final) (arch_finalise_cap arch_cap final)
 2. \<And>arch_cap. \<lbrakk>cdlcap = transform_cap (ArchObjectCap arch_cap); cap = ArchObjectCap arch_cap; arch_cap = ASIDControlCap\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap arch_cap) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap arch_cap)) final) (arch_finalise_cap arch_cap final)
 3. \<And>arch_cap x31 x32 x33 x34 x35. \<lbrakk>cdlcap = transform_cap (ArchObjectCap arch_cap); cap = ArchObjectCap arch_cap; arch_cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap arch_cap) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap arch_cap)) final) (arch_finalise_cap arch_cap final)
 4. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = transform_cap (ArchObjectCap arch_cap); cap = ArchObjectCap arch_cap; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap arch_cap) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap arch_cap)) final) (arch_finalise_cap arch_cap final)
 5. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = transform_cap (ArchObjectCap arch_cap); cap = ArchObjectCap arch_cap; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap arch_cap) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and valid_etcbs) (CSpace_D.finalise_cap (transform_cap (ArchObjectCap arch_cap)) final) (arch_finalise_cap arch_cap final) proof (prove)
goal (4 subgoals):
 1. \<And>arch_cap x11 x12. \<lbrakk>cdlcap = AsidPoolCap x11 (fst (transform_asid x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); arch_cap = ASIDPoolCap x11 x12\<rbrakk> \<Longrightarrow> final \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (ASIDPoolCap x11 x12)) and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt) and cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap x11 x12))) slot and valid_etcbs) (do y <- CSpace_D.delete_asid_pool (fst (transform_asid x12)) x11;
return (cdl_cap.NullCap, cdl_cap.NullCap)
od) (do y <- local.delete_asid_pool x12 x11;
return (cap.NullCap, cap.NullCap)
od)
 2. \<And>arch_cap x31 x32 x33 x34 x35. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35); cap = ArchObjectCap (PageCap x31 x32 x33 x34 x35); arch_cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and valid_etcbs) (CSpace_D.finalise_cap (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) final) (case x35 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> do y <- local.unmap_page x34 a v x32;
return (cap.NullCap, cap.NullCap)
od)
 3. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 4. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (4 subgoals):
 1. \<And>x11 x12. \<lbrakk>cdlcap = AsidPoolCap x11 (fst (transform_asid x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (ASIDPoolCap x11 x12)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap x11 x12))) slot and valid_etcbs) (do y <- CSpace_D.delete_asid_pool (fst (transform_asid x12)) x11;
return (cdl_cap.NullCap, cdl_cap.NullCap)
od) (do y <- local.delete_asid_pool x12 x11;
return (cap.NullCap, cap.NullCap)
od)
 2. \<And>arch_cap x31 x32 x33 x34 x35. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35); cap = ArchObjectCap (PageCap x31 x32 x33 x34 x35); arch_cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and valid_etcbs) (CSpace_D.finalise_cap (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) final) (case x35 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> do y <- local.unmap_page x34 a v x32;
return (cap.NullCap, cap.NullCap)
od)
 3. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 4. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (6 subgoals):
 1. \<And>x11 x12. \<lbrakk>cdlcap = AsidPoolCap x11 (fst (transform_asid x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?Q244 x11 x12) (?Q'244 x11 x12) (do y <- CSpace_D.delete_asid_pool (fst (transform_asid x12)) x11;
return (cdl_cap.NullCap, cdl_cap.NullCap)
od) (do y <- local.delete_asid_pool x12 x11;
return (cap.NullCap, cap.NullCap)
od)
 2. \<And>x11 x12 s. \<lbrakk>cdlcap = AsidPoolCap x11 (fst (transform_asid x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final; True\<rbrakk> \<Longrightarrow> ?Q244 x11 x12 s
 3. \<And>x11 x12 s. \<lbrakk>cdlcap = AsidPoolCap x11 (fst (transform_asid x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final; (invs and valid_cap (ArchObjectCap (ASIDPoolCap x11 x12)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap x11 x12))) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'244 x11 x12 s
 4. \<And>arch_cap x31 x32 x33 x34 x35. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35); cap = ArchObjectCap (PageCap x31 x32 x33 x34 x35); arch_cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and valid_etcbs) (CSpace_D.finalise_cap (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) final) (case x35 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> do y <- local.unmap_page x34 a v x32;
return (cap.NullCap, cap.NullCap)
od)
 5. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 6. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (6 subgoals):
 1. \<And>x11 x12. \<lbrakk>cdlcap = AsidPoolCap x11 (unat (asid_high_bits_of x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?Q244 x11 x12) (?Q'244 x11 x12) (do y <- CSpace_D.delete_asid_pool (unat (asid_high_bits_of x12)) x11;
return (cdl_cap.NullCap, cdl_cap.NullCap)
od) (do y <- local.delete_asid_pool x12 x11;
return (cap.NullCap, cap.NullCap)
od)
 2. \<And>x11 x12 s. \<lbrakk>cdlcap = AsidPoolCap x11 (fst (transform_asid x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final; True\<rbrakk> \<Longrightarrow> ?Q244 x11 x12 s
 3. \<And>x11 x12 s. \<lbrakk>cdlcap = AsidPoolCap x11 (fst (transform_asid x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final; (invs and valid_cap (ArchObjectCap (ASIDPoolCap x11 x12)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap x11 x12))) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'244 x11 x12 s
 4. \<And>arch_cap x31 x32 x33 x34 x35. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35); cap = ArchObjectCap (PageCap x31 x32 x33 x34 x35); arch_cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and valid_etcbs) (CSpace_D.finalise_cap (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) final) (case x35 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> do y <- local.unmap_page x34 a v x32;
return (cap.NullCap, cap.NullCap)
od)
 5. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 6. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (8 subgoals):
 1. \<And>x11 x12 y ya. \<lbrakk>cdlcap = AsidPoolCap x11 (unat (asid_high_bits_of x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final; dc y ya\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?R248 x11 x12 y) (?R'248 x11 x12 ya) (return (cdl_cap.NullCap, cdl_cap.NullCap)) (return (cap.NullCap, cap.NullCap))
 2. \<And>x11 x12. \<lbrakk>cdlcap = AsidPoolCap x11 (unat (asid_high_bits_of x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final\<rbrakk> \<Longrightarrow> \<lbrace>?Q248 x11 x12\<rbrace> CSpace_D.delete_asid_pool (unat (asid_high_bits_of x12)) x11 \<lbrace>?R248 x11 x12\<rbrace>
 3. \<And>x11 x12. \<lbrakk>cdlcap = AsidPoolCap x11 (unat (asid_high_bits_of x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'248 x11 x12\<rbrace> local.delete_asid_pool x12 x11 \<lbrace>?R'248 x11 x12\<rbrace>
 4. \<And>x11 x12 s. \<lbrakk>cdlcap = AsidPoolCap x11 (fst (transform_asid x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q248 x11 x12) s
 5. \<And>x11 x12 s. \<lbrakk>cdlcap = AsidPoolCap x11 (fst (transform_asid x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final; (invs and valid_cap (ArchObjectCap (ASIDPoolCap x11 x12)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap x11 x12))) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'248 x11 x12) s
 6. \<And>arch_cap x31 x32 x33 x34 x35. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35); cap = ArchObjectCap (PageCap x31 x32 x33 x34 x35); arch_cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and valid_etcbs) (CSpace_D.finalise_cap (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) final) (case x35 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> do y <- local.unmap_page x34 a v x32;
return (cap.NullCap, cap.NullCap)
od)
 7. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 8. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (8 subgoals):
 1. \<And>x11 x12 y ya. \<lbrakk>cdlcap = AsidPoolCap x11 (unat (asid_high_bits_of x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final; dc y ya\<rbrakk> \<Longrightarrow> (\<exists>s s'. True \<and> True \<and> (s, s') \<in> {ss'. transform (snd ss') = fst ss'}) \<longrightarrow> fst (cdl_cap.NullCap, cdl_cap.NullCap) = transform_cap (fst (cap.NullCap, cap.NullCap))
 2. \<And>x11 x12. \<lbrakk>cdlcap = AsidPoolCap x11 (unat (asid_high_bits_of x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final\<rbrakk> \<Longrightarrow> \<lbrace>?Q248 x11 x12\<rbrace> CSpace_D.delete_asid_pool (unat (asid_high_bits_of x12)) x11 \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>x11 x12. \<lbrakk>cdlcap = AsidPoolCap x11 (unat (asid_high_bits_of x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'248 x11 x12\<rbrace> local.delete_asid_pool x12 x11 \<lbrace>\<lambda>ya _. True\<rbrace>
 4. \<And>x11 x12 s. \<lbrakk>cdlcap = AsidPoolCap x11 (fst (transform_asid x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q248 x11 x12) s
 5. \<And>x11 x12 s. \<lbrakk>cdlcap = AsidPoolCap x11 (fst (transform_asid x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final; (invs and valid_cap (ArchObjectCap (ASIDPoolCap x11 x12)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap x11 x12))) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'248 x11 x12) s
 6. \<And>arch_cap x31 x32 x33 x34 x35. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35); cap = ArchObjectCap (PageCap x31 x32 x33 x34 x35); arch_cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and valid_etcbs) (CSpace_D.finalise_cap (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) final) (case x35 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> do y <- local.unmap_page x34 a v x32;
return (cap.NullCap, cap.NullCap)
od)
 7. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 8. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (7 subgoals):
 1. \<And>x11 x12. \<lbrakk>cdlcap = AsidPoolCap x11 (unat (asid_high_bits_of x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final\<rbrakk> \<Longrightarrow> \<lbrace>?Q248 x11 x12\<rbrace> CSpace_D.delete_asid_pool (unat (asid_high_bits_of x12)) x11 \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>x11 x12. \<lbrakk>cdlcap = AsidPoolCap x11 (unat (asid_high_bits_of x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'248 x11 x12\<rbrace> local.delete_asid_pool x12 x11 \<lbrace>\<lambda>ya _. True\<rbrace>
 3. \<And>x11 x12 s. \<lbrakk>cdlcap = AsidPoolCap x11 (fst (transform_asid x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q248 x11 x12) s
 4. \<And>x11 x12 s. \<lbrakk>cdlcap = AsidPoolCap x11 (fst (transform_asid x12)); cap = ArchObjectCap (ASIDPoolCap x11 x12); final; (invs and valid_cap (ArchObjectCap (ASIDPoolCap x11 x12)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap x11 x12))) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'248 x11 x12) s
 5. \<And>arch_cap x31 x32 x33 x34 x35. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35); cap = ArchObjectCap (PageCap x31 x32 x33 x34 x35); arch_cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and valid_etcbs) (CSpace_D.finalise_cap (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) final) (case x35 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> do y <- local.unmap_page x34 a v x32;
return (cap.NullCap, cap.NullCap)
od)
 6. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 7. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35); cap = ArchObjectCap (PageCap x31 x32 x33 x34 x35)\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and valid_etcbs) (CSpace_D.finalise_cap (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) final) (case x35 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> do y <- local.unmap_page x34 a v x32;
return (cap.NullCap, cap.NullCap)
od)
 2. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 3. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping None); cap = ArchObjectCap (PageCap x31 x32 x33 x34 None)\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 None)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) slot and valid_etcbs) (CSpace_D.finalise_cap (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping None)) final) (return (cap.NullCap, cap.NullCap))
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35); cap = ArchObjectCap (PageCap x31 x32 x33 x34 x35)\<rbrakk> \<Longrightarrow> \<forall>a b. x35 = Some (a, b) \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))))) slot and valid_etcbs) (CSpace_D.finalise_cap (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping (Some (a, b)))) final) (do y <- local.unmap_page x34 a b x32;
return (cap.NullCap, cap.NullCap)
od)
 3. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 4. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35); cap = ArchObjectCap (PageCap x31 x32 x33 x34 x35)\<rbrakk> \<Longrightarrow> \<forall>a b. x35 = Some (a, b) \<longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))))) slot and valid_etcbs) (CSpace_D.finalise_cap (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping (Some (a, b)))) final) (do y <- local.unmap_page x34 a b x32;
return (cap.NullCap, cap.NullCap)
od)
 2. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 3. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 a b. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b)))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))))) slot and valid_etcbs) (do y <- PageTableUnmap_D.unmap_page (transform_asid a, b) x32 (pageBitsForSize x34);
return (cdl_cap.NullCap, cdl_cap.NullCap)
od) (do y <- local.unmap_page x34 a b x32;
return (cap.NullCap, cap.NullCap)
od)
 2. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 3. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (5 subgoals):
 1. \<And>x31 x32 x33 x34 a b. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b)))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?Q284 x31 x32 x33 x34 a b) (?Q'284 x31 x32 x33 x34 a b) (do y <- PageTableUnmap_D.unmap_page (transform_asid a, b) x32 (pageBitsForSize x34);
return (cdl_cap.NullCap, cdl_cap.NullCap)
od) (do y <- local.unmap_page x34 a b x32;
return (cap.NullCap, cap.NullCap)
od)
 2. \<And>x31 x32 x33 x34 a b s. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))); True\<rbrakk> \<Longrightarrow> ?Q284 x31 x32 x33 x34 a b s
 3. \<And>x31 x32 x33 x34 a b s. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))); (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))))) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'284 x31 x32 x33 x34 a b s
 4. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 5. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (7 subgoals):
 1. \<And>x31 x32 x33 x34 a b y ya. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))); dc y ya\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?R288 x31 x32 x33 x34 a b y) (?R'288 x31 x32 x33 x34 a b ya) (return (cdl_cap.NullCap, cdl_cap.NullCap)) (return (cap.NullCap, cap.NullCap))
 2. \<And>x31 x32 x33 x34 a b. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q288 x31 x32 x33 x34 a b\<rbrace> PageTableUnmap_D.unmap_page (transform_asid a, b) x32 (pageBitsForSize x34) \<lbrace>?R288 x31 x32 x33 x34 a b\<rbrace>
 3. \<And>x31 x32 x33 x34 a b. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'288 x31 x32 x33 x34 a b\<rbrace> local.unmap_page x34 a b x32 \<lbrace>?R'288 x31 x32 x33 x34 a b\<rbrace>
 4. \<And>x31 x32 x33 x34 a b s. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q288 x31 x32 x33 x34 a b) s
 5. \<And>x31 x32 x33 x34 a b s. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))); (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))))) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap (?dev289 x31 x32 x33 x34 a b) x32 (?fun289 x31 x32 x33 x34 a b) x34 (Some (a, b)))) and ?Q'288 x31 x32 x33 x34 a b) s
 6. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 7. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (7 subgoals):
 1. \<And>x31 x32 x33 x34 a b y ya. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))); dc y ya\<rbrakk> \<Longrightarrow> (\<exists>s s'. True \<and> True \<and> (s, s') \<in> {ss'. transform (snd ss') = fst ss'}) \<longrightarrow> fst (cdl_cap.NullCap, cdl_cap.NullCap) = transform_cap (fst (cap.NullCap, cap.NullCap))
 2. \<And>x31 x32 x33 x34 a b. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q288 x31 x32 x33 x34 a b\<rbrace> PageTableUnmap_D.unmap_page (transform_asid a, b) x32 (pageBitsForSize x34) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>x31 x32 x33 x34 a b. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'288 x31 x32 x33 x34 a b\<rbrace> local.unmap_page x34 a b x32 \<lbrace>\<lambda>ya _. True\<rbrace>
 4. \<And>x31 x32 x33 x34 a b s. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q288 x31 x32 x33 x34 a b) s
 5. \<And>x31 x32 x33 x34 a b s. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))); (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))))) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap (?dev289 x31 x32 x33 x34 a b) x32 (?fun289 x31 x32 x33 x34 a b) x34 (Some (a, b)))) and ?Q'288 x31 x32 x33 x34 a b) s
 6. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 7. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (6 subgoals):
 1. \<And>x31 x32 x33 x34 a b. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q288 x31 x32 x33 x34 a b\<rbrace> PageTableUnmap_D.unmap_page (transform_asid a, b) x32 (pageBitsForSize x34) \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>x31 x32 x33 x34 a b. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'288 x31 x32 x33 x34 a b\<rbrace> local.unmap_page x34 a b x32 \<lbrace>\<lambda>ya _. True\<rbrace>
 3. \<And>x31 x32 x33 x34 a b s. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q288 x31 x32 x33 x34 a b) s
 4. \<And>x31 x32 x33 x34 a b s. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))); (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))))) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap (?dev289 x31 x32 x33 x34 a b) x32 (?fun289 x31 x32 x33 x34 a b) x34 (Some (a, b)))) and ?Q'288 x31 x32 x33 x34 a b) s
 5. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 6. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 a b s. \<lbrakk>cdlcap = FrameCap x31 x32 x33 (pageBitsForSize x34) Real (Some (transform_asid a, b)); cap = ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))); invs s; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))))) slot s; valid_etcbs s\<rbrakk> \<Longrightarrow> s \<turnstile> ArchObjectCap (PageCap (?dev289 x31 x32 x33 x34 a b) x32 (?fun289 x31 x32 x33 x34 a b) x34 (Some (a, b)))
 2. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 3. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>arch_cap x41 x42. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (transform_mapping x42); cap = ArchObjectCap (arch_cap.PageTableCap x41 x42); arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 x42)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 x42))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageTableCap x41 Real (transform_mapping x42)) final) (case x42 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some (a, v) \<Rightarrow> case final of True \<Rightarrow> do local.unmap_page_table a v x41;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap))
 2. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>x41 a b. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) (do y <- PageTableUnmap_D.unmap_page_table (transform_asid a, b) x41;
return (cdl_cap.NullCap, cdl_cap.NullCap)
od) (do y <- local.unmap_page_table a b x41;
return (cap.NullCap, cap.NullCap)
od)
 2. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (2 subgoals):
 1. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) ((=) s) ((=) s') (do y <- PageTableUnmap_D.unmap_page_table (transform_asid a, b) x41;
return (cdl_cap.NullCap, cdl_cap.NullCap)
od) (do y <- local.unmap_page_table a b x41;
return (cap.NullCap, cap.NullCap)
od)
 2. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (4 subgoals):
 1. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?Q329 x41 a b s s') (?Q'329 x41 a b s s') (do y <- PageTableUnmap_D.unmap_page_table (transform_asid a, b) x41;
return (cdl_cap.NullCap, cdl_cap.NullCap)
od) (do y <- local.unmap_page_table a b x41;
return (cap.NullCap, cap.NullCap)
od)
 2. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s = sa\<rbrakk> \<Longrightarrow> ?Q329 x41 a b s s' sa
 3. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s' = sa\<rbrakk> \<Longrightarrow> ?Q'329 x41 a b s s' sa
 4. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (7 subgoals):
 1. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> dcorres (?r'333 x41 a b s s') (?P333 x41 a b s s') (?P'333 x41 a b s s') (PageTableUnmap_D.unmap_page_table (transform_asid a, b) x41) (local.unmap_page_table a b x41)
 2. \<And>x41 a b s s' y ya. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; ?r'333 x41 a b s s' y ya\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?R333 x41 a b s s' y) (?R'333 x41 a b s s' ya) (return (cdl_cap.NullCap, cdl_cap.NullCap)) (return (cap.NullCap, cap.NullCap))
 3. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q333 x41 a b s s'\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid a, b) x41 \<lbrace>?R333 x41 a b s s'\<rbrace>
 4. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'333 x41 a b s s'\<rbrace> local.unmap_page_table a b x41 \<lbrace>?R'333 x41 a b s s'\<rbrace>
 5. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s = sa\<rbrakk> \<Longrightarrow> (?P333 x41 a b s s' and ?Q333 x41 a b s s') sa
 6. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s' = sa\<rbrakk> \<Longrightarrow> (?P'333 x41 a b s s' and ?Q'333 x41 a b s s') sa
 7. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (9 subgoals):
 1. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> a \<le> mask local.asid_bits
 2. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> b < kernel_base
 3. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> vmsz_aligned b ARMSection
 4. \<And>x41 a b s s' y ya. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; dc y ya\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?R333 x41 a b s s' y) (?R'333 x41 a b s s' ya) (return (cdl_cap.NullCap, cdl_cap.NullCap)) (return (cap.NullCap, cap.NullCap))
 5. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q333 x41 a b s s'\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid a, b) x41 \<lbrace>?R333 x41 a b s s'\<rbrace>
 6. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'333 x41 a b s s'\<rbrace> local.unmap_page_table a b x41 \<lbrace>?R'333 x41 a b s s'\<rbrace>
 7. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q333 x41 a b s s') sa
 8. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s' = sa\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and ?Q'333 x41 a b s s') sa
 9. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (9 subgoals):
 1. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> a < 2 ^ local.asid_bits
 2. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> b < kernel_base
 3. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> vmsz_aligned b ARMSection
 4. \<And>x41 a b s s' y ya. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; dc y ya\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?R333 x41 a b s s' y) (?R'333 x41 a b s s' ya) (return (cdl_cap.NullCap, cdl_cap.NullCap)) (return (cap.NullCap, cap.NullCap))
 5. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q333 x41 a b s s'\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid a, b) x41 \<lbrace>?R333 x41 a b s s'\<rbrace>
 6. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'333 x41 a b s s'\<rbrace> local.unmap_page_table a b x41 \<lbrace>?R'333 x41 a b s s'\<rbrace>
 7. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q333 x41 a b s s') sa
 8. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s' = sa\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and ?Q'333 x41 a b s s') sa
 9. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (7 subgoals):
 1. \<And>x41 a b s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; invs s'; is_aligned x41 10; 10 < word_bits; typ_at (AArch APageTable) x41 s'; 0 < a; a < 2 ^ local.asid_bits; b < kernel_base; is_aligned b 20; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> vmsz_aligned b ARMSection
 2. \<And>x41 a b s s' y ya. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; dc y ya\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?R333 x41 a b s s' y) (?R'333 x41 a b s s' ya) (return (cdl_cap.NullCap, cdl_cap.NullCap)) (return (cap.NullCap, cap.NullCap))
 3. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q333 x41 a b s s'\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid a, b) x41 \<lbrace>?R333 x41 a b s s'\<rbrace>
 4. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'333 x41 a b s s'\<rbrace> local.unmap_page_table a b x41 \<lbrace>?R'333 x41 a b s s'\<rbrace>
 5. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q333 x41 a b s s') sa
 6. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s' = sa\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and ?Q'333 x41 a b s s') sa
 7. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (6 subgoals):
 1. \<And>x41 a b s s' y ya. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; dc y ya\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?R333 x41 a b s s' y) (?R'333 x41 a b s s' ya) (return (cdl_cap.NullCap, cdl_cap.NullCap)) (return (cap.NullCap, cap.NullCap))
 2. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q333 x41 a b s s'\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid a, b) x41 \<lbrace>?R333 x41 a b s s'\<rbrace>
 3. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'333 x41 a b s s'\<rbrace> local.unmap_page_table a b x41 \<lbrace>?R'333 x41 a b s s'\<rbrace>
 4. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q333 x41 a b s s') sa
 5. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s' = sa\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and ?Q'333 x41 a b s s') sa
 6. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (6 subgoals):
 1. \<And>x41 a b s s' y ya. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; dc y ya\<rbrakk> \<Longrightarrow> (\<exists>s s'. True \<and> True \<and> (s, s') \<in> {ss'. transform (snd ss') = fst ss'}) \<longrightarrow> fst (cdl_cap.NullCap, cdl_cap.NullCap) = transform_cap (fst (cap.NullCap, cap.NullCap))
 2. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q333 x41 a b s s'\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid a, b) x41 \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'333 x41 a b s s'\<rbrace> local.unmap_page_table a b x41 \<lbrace>\<lambda>ya _. True\<rbrace>
 4. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q333 x41 a b s s') sa
 5. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s' = sa\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and ?Q'333 x41 a b s s') sa
 6. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (5 subgoals):
 1. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q333 x41 a b s s'\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid a, b) x41 \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>x41 a b s s'. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'333 x41 a b s s'\<rbrace> local.unmap_page_table a b x41 \<lbrace>\<lambda>ya _. True\<rbrace>
 3. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q333 x41 a b s s') sa
 4. \<And>x41 a b s s' sa. \<lbrakk>cdlcap = cdl_cap.PageTableCap x41 Real (Some (transform_asid a, b)); cap = ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))); final; s = transform s'; True; (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b))))) slot and valid_etcbs) s'; s' = sa\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x41 (Some (a, b)))) and ?Q'333 x41 a b s s') sa
 5. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (1 subgoal):
 1. \<And>arch_cap x51 x52. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 x52); arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 x52))) slot and valid_etcbs) (CSpace_D.finalise_cap (cdl_cap.PageDirectoryCap x51 Real (map_option transform_asid x52)) final) (case x52 of None \<Rightarrow> return (cap.NullCap, cap.NullCap) | Some a \<Rightarrow> case final of True \<Rightarrow> do local.delete_asid a x51;
return (cap.NullCap, cap.NullCap)
od | False \<Rightarrow> return (cap.NullCap, cap.NullCap)) proof (prove)
goal (1 subgoal):
 1. \<And>x51 x2. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (\<lambda>_. True) (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) slot and valid_etcbs) (do y <- CSpace_D.delete_asid (transform_asid x2) x51;
return (cdl_cap.NullCap, cdl_cap.NullCap)
od) (do y <- local.delete_asid x2 x51;
return (cap.NullCap, cap.NullCap)
od) proof (prove)
goal (3 subgoals):
 1. \<And>x51 x2. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?Q387 x51 x2) (?Q'387 x51 x2) (do y <- CSpace_D.delete_asid (transform_asid x2) x51;
return (cdl_cap.NullCap, cdl_cap.NullCap)
od) (do y <- local.delete_asid x2 x51;
return (cap.NullCap, cap.NullCap)
od)
 2. \<And>x51 x2 s. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final; True\<rbrakk> \<Longrightarrow> ?Q387 x51 x2 s
 3. \<And>x51 x2 s. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final; (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'387 x51 x2 s proof (prove)
goal (5 subgoals):
 1. \<And>x51 x2 y ya. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final; dc y ya\<rbrakk> \<Longrightarrow> dcorres (\<lambda>r r'. fst r = transform_cap (fst r')) (?R391 x51 x2 y) (?R'391 x51 x2 ya) (return (cdl_cap.NullCap, cdl_cap.NullCap)) (return (cap.NullCap, cap.NullCap))
 2. \<And>x51 x2. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final\<rbrakk> \<Longrightarrow> \<lbrace>?Q391 x51 x2\<rbrace> CSpace_D.delete_asid (transform_asid x2) x51 \<lbrace>?R391 x51 x2\<rbrace>
 3. \<And>x51 x2. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'391 x51 x2\<rbrace> local.delete_asid x2 x51 \<lbrace>?R'391 x51 x2\<rbrace>
 4. \<And>x51 x2 s. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q391 x51 x2) s
 5. \<And>x51 x2 s. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final; (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_idle and ?Q'391 x51 x2) s proof (prove)
goal (5 subgoals):
 1. \<And>x51 x2 y ya. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final; dc y ya\<rbrakk> \<Longrightarrow> (\<exists>s s'. True \<and> True \<and> (s, s') \<in> {ss'. transform (snd ss') = fst ss'}) \<longrightarrow> fst (cdl_cap.NullCap, cdl_cap.NullCap) = transform_cap (fst (cap.NullCap, cap.NullCap))
 2. \<And>x51 x2. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final\<rbrakk> \<Longrightarrow> \<lbrace>?Q391 x51 x2\<rbrace> CSpace_D.delete_asid (transform_asid x2) x51 \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>x51 x2. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'391 x51 x2\<rbrace> local.delete_asid x2 x51 \<lbrace>\<lambda>ya _. True\<rbrace>
 4. \<And>x51 x2 s. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q391 x51 x2) s
 5. \<And>x51 x2 s. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final; (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_idle and ?Q'391 x51 x2) s proof (prove)
goal (4 subgoals):
 1. \<And>x51 x2. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final\<rbrakk> \<Longrightarrow> \<lbrace>?Q391 x51 x2\<rbrace> CSpace_D.delete_asid (transform_asid x2) x51 \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>x51 x2. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final\<rbrakk> \<Longrightarrow> \<lbrace>?Q'391 x51 x2\<rbrace> local.delete_asid x2 x51 \<lbrace>\<lambda>ya _. True\<rbrace>
 3. \<And>x51 x2 s. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q391 x51 x2) s
 4. \<And>x51 x2 s. \<lbrakk>cdlcap = cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)); cap = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); final; (invs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) slot and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_idle and ?Q'391 x51 x2) s proof (prove)
goal:
No subgoals!